|
32831
|
1254
|
17
|
2026-05-13T09:39:00.261758+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665140261_m1.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37?selectedIssue=JY-20613...
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-916921658593694521
|
-130958617327879038
|
click
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32832
|
1255
|
21
|
2026-05-13T09:39:00.261714+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665140261_m2.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37?selectedIssue=JY-20613...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
754453782058960156
|
-130677142351168378
|
click
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail...
|
32830
|
NULL
|
NULL
|
NULL
|
|
32833
|
1255
|
22
|
2026-05-13T09:39:05.308811+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665145308_m2.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37?selectedIssue=JY-20613...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
4873171364053860360
|
-418916315636089722
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32834
|
1254
|
18
|
2026-05-13T09:39:06.439410+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665146439_m1.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37?selectedIssue=JY-20613...
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
6513331008030405837
|
-418916315636351866
|
click
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the...
|
32831
|
NULL
|
NULL
|
NULL
|
|
32835
|
1255
|
23
|
2026-05-13T09:39:06.439420+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665146439_m2.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37?selectedIssue=JY-20613...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
317096745129758518
|
-418916315636351866
|
click
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on...
|
32833
|
NULL
|
NULL
|
NULL
|
|
32841
|
1255
|
27
|
2026-05-13T09:39:36.545644+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665176545_m2.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37?selectedIssue=JY-20613...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment
Risk Assessment
CVSS Score:
7.8 (High)
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requirement:
Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.
Resolution and Mitigation
Resolution and Mitigation
Official Patch:
The maintainer updated PHPUnit to treat pre-existing
.coverage
files as an error condition rather than attempting to sanitize and process them.
Recommended Actions:
* Update PHPUnit to the latest patched version in your respective release branch.
Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.
Enforce code reviews and branch protection to prevent malicious file injection.
Good response
Bad response...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"7.8 (High)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requirement:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Resolution and Mitigation","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Resolution and Mitigation","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Official Patch:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The maintainer updated PHPUnit to treat pre-existing","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files as an error condition rather than attempting to sanitize and process them.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Recommended Actions:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"* Update PHPUnit to the latest patched version in your respective release branch.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Enforce code reviews and branch protection to prevent malicious file injection.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
-777471817991621511
|
-2436458579961495930
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment
Risk Assessment
CVSS Score:
7.8 (High)
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requirement:
Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.
Resolution and Mitigation
Resolution and Mitigation
Official Patch:
The maintainer updated PHPUnit to treat pre-existing
.coverage
files as an error condition rather than attempting to sanitize and process them.
Recommended Actions:
* Update PHPUnit to the latest patched version in your respective release branch.
Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.
Enforce code reviews and branch protection to prevent malicious file injection.
Good response
Bad response...
|
32840
|
NULL
|
NULL
|
NULL
|
|
32842
|
1254
|
21
|
2026-05-13T09:39:37.493217+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665177493_m1.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37?selectedIssue=JY-20613...
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
1350747717223826888
|
-419760739526034298
|
click
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32843
|
1255
|
28
|
2026-05-13T09:39:37.475060+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665177475_m2.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37?selectedIssue=JY-20613...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
5524120428439851200
|
-419197789539058554
|
click
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32844
|
1255
|
29
|
2026-05-13T09:39:39.540153+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665179540_m2.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37?selectedIssue=JY-20613...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"}]...
|
-5214972455588130550
|
-130685939493028218
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment...
|
32843
|
NULL
|
NULL
|
NULL
|
|
32851
|
1255
|
33
|
2026-05-13T09:39:54.648209+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665194648_m2.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37?selectedIssue=JY-20613...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment
Risk Assessment
CVSS Score:
7.8 (High)
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requirement:
Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.
Resolution and Mitigation
Resolution and Mitigation
Official Patch:
The maintainer updated PHPUnit to treat pre-existing
.coverage
files as an error condition rather than attempting to sanitize and process them.
Recommended Actions:
* Update PHPUnit to the latest patched version in your respective release branch.
Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.
Enforce code reviews and branch protection to prevent malicious file injection.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I fix these vulnareabilities in laravel project
You said
how can I fix these vulnareabilities in laravel project
Listen
Show thinking
Gemini said
Gemini said
Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.
Here is exactly how to secure your project:
1. Check Your Current Version
1. Check Your Current Version
First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:
Bash
Download code
Copy code
composer show phpunit/phpunit
Look at the
versions
line in the output to see if you are running a vulnerable version (anything lower than 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52).
2. Update PHPUnit
2. Update PHPUnit
Tell Composer to update PHPUnit and its associated dependencies to the latest secure versions allowed by your
composer.json
constraints:
Bash
Download code
Copy code
composer update phpunit/phpunit --with-dependencies
Note: If your
composer.json
restricts PHPUnit to an older major version (like
^9.0
), Composer will automatically grab the secure patch for that specific major version (e.g., 9.6.33).
3. Verify the Fix
3. Verify the Fix
Run the
composer show
command from step one again to confirm the version has been bumped. As long as your version is at or above one of the secure releases listed above, you are protected against CVE-2026-24765.
4. Secure Your Environments
4. Secure Your Environments
Because PHPUnit lives in the
require-dev
block of your
composer.json
, this vulnerability does not impact your production environment—
provided you are deploying correctly
.
Always build your production environment using
composer install --no-dev --optimize-autoloader
. This ensures testing frameworks are completely excluded from your live servers.
For your CI/CD pipelines, ensure you are using ephemeral runners (runners that spin up fresh for every job and are destroyed afterward) so that an attacker cannot leave a malicious
.coverage
file behind for a subsequent test run to execute.
Would you like me to walk you through how to verify that your production server is completely free of development dependencies?
Good response
Bad response
Share & export
Copy
Show more options...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"7.8 (High)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requirement:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Resolution and Mitigation","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Resolution and Mitigation","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Official Patch:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The maintainer updated PHPUnit to treat pre-existing","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files as an error condition rather than attempting to sanitize and process them.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Recommended Actions:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"* Update PHPUnit to the latest patched version in your respective release branch.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Enforce code reviews and branch protection to prevent malicious file injection.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I fix these vulnareabilities in laravel project","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I fix these vulnareabilities in laravel project","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly how to secure your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check Your Current Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check Your Current Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer show phpunit/phpunit","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Look at the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"line in the output to see if you are running a vulnerable version (anything lower than 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Update PHPUnit","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Update PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tell Composer to update PHPUnit and its associated dependencies to the latest secure versions allowed by your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"constraints:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer update phpunit/phpunit --with-dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Note: If your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"restricts PHPUnit to an older major version (like","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"^9.0","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), Composer will automatically grab the secure patch for that specific major version (e.g., 9.6.33).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Verify the Fix","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Verify the Fix","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer show","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"command from step one again to confirm the version has been bumped. As long as your version is at or above one of the secure releases listed above, you are protected against CVE-2026-24765.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Secure Your Environments","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Secure Your Environments","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because PHPUnit lives in the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"require-dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"block of your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", this vulnerability does not impact your production environment—","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"provided you are deploying correctly","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Always build your production environment using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer install --no-dev --optimize-autoloader","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". This ensures testing frameworks are completely excluded from your live servers.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"For your CI/CD pipelines, ensure you are using ephemeral runners (runners that spin up fresh for every job and are destroyed afterward) so that an attacker cannot leave a malicious","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file behind for a subsequent test run to execute.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Would you like me to walk you through how to verify that your production server is completely free of development dependencies?","depth":24,"bounds":{"left":0.08959442,"top":0.0,"width":0.11502659,"height":0.057861134},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.086269945,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.09690824,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.107546546,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.11818484,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.12882313,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
-95643920771995551
|
-2359967755073929594
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment
Risk Assessment
CVSS Score:
7.8 (High)
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requirement:
Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.
Resolution and Mitigation
Resolution and Mitigation
Official Patch:
The maintainer updated PHPUnit to treat pre-existing
.coverage
files as an error condition rather than attempting to sanitize and process them.
Recommended Actions:
* Update PHPUnit to the latest patched version in your respective release branch.
Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.
Enforce code reviews and branch protection to prevent malicious file injection.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I fix these vulnareabilities in laravel project
You said
how can I fix these vulnareabilities in laravel project
Listen
Show thinking
Gemini said
Gemini said
Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.
Here is exactly how to secure your project:
1. Check Your Current Version
1. Check Your Current Version
First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:
Bash
Download code
Copy code
composer show phpunit/phpunit
Look at the
versions
line in the output to see if you are running a vulnerable version (anything lower than 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52).
2. Update PHPUnit
2. Update PHPUnit
Tell Composer to update PHPUnit and its associated dependencies to the latest secure versions allowed by your
composer.json
constraints:
Bash
Download code
Copy code
composer update phpunit/phpunit --with-dependencies
Note: If your
composer.json
restricts PHPUnit to an older major version (like
^9.0
), Composer will automatically grab the secure patch for that specific major version (e.g., 9.6.33).
3. Verify the Fix
3. Verify the Fix
Run the
composer show
command from step one again to confirm the version has been bumped. As long as your version is at or above one of the secure releases listed above, you are protected against CVE-2026-24765.
4. Secure Your Environments
4. Secure Your Environments
Because PHPUnit lives in the
require-dev
block of your
composer.json
, this vulnerability does not impact your production environment—
provided you are deploying correctly
.
Always build your production environment using
composer install --no-dev --optimize-autoloader
. This ensures testing frameworks are completely excluded from your live servers.
For your CI/CD pipelines, ensure you are using ephemeral runners (runners that spin up fresh for every job and are destroyed afterward) so that an attacker cannot leave a malicious
.coverage
file behind for a subsequent test run to execute.
Would you like me to walk you through how to verify that your production server is completely free of development dependencies?
Good response
Bad response
Share & export
Copy
Show more options...
|
32850
|
NULL
|
NULL
|
NULL
|
|
32852
|
1254
|
25
|
2026-05-13T09:39:55.483512+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665195483_m1.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37?selectedIssue=JY-20613...
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
4371409673504374984
|
-130685939484377466
|
click
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32853
|
1255
|
34
|
2026-05-13T09:39:55.475061+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665195475_m2.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37?selectedIssue=JY-20613...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-2656619366988133639
|
-130685939493028218
|
click
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32854
|
1255
|
35
|
2026-05-13T09:39:57.650046+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665197650_m2.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37?selectedIssue=JY-20613...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Ask Google Gemini
Platform Sprint 4 Q2 - Platform Ask Google Gemini
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment
Risk Assessment
CVSS Score:
7.8 (High)
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requirement:
Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.
Resolution and Mitigation
Resolution and Mitigation
Official Patch:
The maintainer updated PHPUnit to treat pre-existing
.coverage
files as an error condition rather than attempting to sanitize and process them.
Recommended Actions:
* Update PHPUnit to the latest patched version in your respective release branch.
Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.
Enforce code reviews and branch protection to prevent malicious file injection.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I fix these vulnareabilities in laravel project
You said
how can I fix these vulnareabilities in laravel project
Listen...
|
[{"role":"AXButton","text" [{"role":"AXButton","text":"Ask Google Gemini","depth":4,"bounds":{"left":0.5834442,"top":0.7661612,"width":0.011303191,"height":0.027134877},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"7.8 (High)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requirement:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Resolution and Mitigation","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Resolution and Mitigation","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Official Patch:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The maintainer updated PHPUnit to treat pre-existing","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files as an error condition rather than attempting to sanitize and process them.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Recommended Actions:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"* Update PHPUnit to the latest patched version in your respective release branch.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Enforce code reviews and branch protection to prevent malicious file injection.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I fix these vulnareabilities in laravel project","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I fix these vulnareabilities in laravel project","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
1593720089271571305
|
-130685939491717498
|
visual_change
|
accessibility
|
NULL
|
Ask Google Gemini
Platform Sprint 4 Q2 - Platform Ask Google Gemini
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment
Risk Assessment
CVSS Score:
7.8 (High)
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requirement:
Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.
Resolution and Mitigation
Resolution and Mitigation
Official Patch:
The maintainer updated PHPUnit to treat pre-existing
.coverage
files as an error condition rather than attempting to sanitize and process them.
Recommended Actions:
* Update PHPUnit to the latest patched version in your respective release branch.
Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.
Enforce code reviews and branch protection to prevent malicious file injection.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I fix these vulnareabilities in laravel project
You said
how can I fix these vulnareabilities in laravel project
Listen...
|
32853
|
NULL
|
NULL
|
NULL
|
|
32938
|
1259
|
8
|
2026-05-13T09:51:37.280056+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665897280_m2.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit
name : phpunit/phpunit
descrip. : The PHP Unit Testing framework.
keywords : phpunit, testing, xunit
versions : * 11.5.55
type : library
license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText
homepage : https://phpunit.de/
source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00
dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00
path : /home/jiminny/vendor/phpunit/phpunit
names : phpunit/phpunit
support
issues : https://github.com/sebastianbergmann/phpunit/issues
security : https://github.com/sebastianbergmann/phpunit/security/policy
source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55
autoload
files
classmap
src/
requires
ext-dom *
ext-json *
ext-libxml *
ext-mbstring *
ext-xml *
ext-xmlwriter *
myclabs/deep-copy ^1.13.4
phar-io/manifest ^2.0.4
phar-io/version ^3.2.1
php >=8.2
phpunit/php-code-coverage ^11.0.12
phpunit/php-file-iterator ^5.1.1
phpunit/php-invoker ^5.0.1
phpunit/php-text-template ^4.0.1
phpunit/php-timer ^7.0.1
sebastian/cli-parser ^3.0.2
sebastian/code-unit ^3.0.3
sebastian/comparator ^6.3.3
sebastian/diff ^6.0.2
sebastian/environment ^7.2.1
sebastian/exporter ^6.3.2
sebastian/global-state ^7.0.2
sebastian/object-enumerator ^6.0.1
sebastian/recursion-context ^6.0.3
sebastian/type ^5.1.3
sebastian/version ^5.0.2
staabm/side-effects-detector ^1.0.5
suggests
ext-soap To be able to generate mocks based on WSDL files
Expand
Listen
Show thinking
Gemini said
Gemini said
Assessment: Safe
Assessment: Safe
Based on the terminal output you provided, your Laravel project is
not vulnerable
to CVE-2026-24765.
Your Installed Version:
11.5.55
Secure Patched Version:
11.5.50
(for the 11.x release branch)
Because you are running
11.5.55
, which is newer than the required security patch, the unsafe deserialization flaw in the
cleanupForCoverage()
method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.
A quick reminder on best practices:
Since you are running this inside a Docker container (
docker_lamp_1
), just ensure that when you build your production container images, you continue to use the
--no-dev
flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"7.8 (High)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requirement:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Resolution and Mitigation","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Resolution and Mitigation","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Official Patch:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The maintainer updated PHPUnit to treat pre-existing","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files as an error condition rather than attempting to sanitize and process them.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Recommended Actions:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"* Update PHPUnit to the latest patched version in your respective release branch.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Enforce code reviews and branch protection to prevent malicious file injection.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I fix these vulnareabilities in laravel project","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I fix these vulnareabilities in laravel project","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly how to secure your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check Your Current Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check Your Current Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer show phpunit/phpunit","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Look at the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"line in the output to see if you are running a vulnerable version (anything lower than 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Update PHPUnit","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Update PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tell Composer to update PHPUnit and its associated dependencies to the latest secure versions allowed by your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"constraints:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer update phpunit/phpunit --with-dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Note: If your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"restricts PHPUnit to an older major version (like","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"^9.0","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), Composer will automatically grab the secure patch for that specific major version (e.g., 9.6.33).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Verify the Fix","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Verify the Fix","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer show","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"command from step one again to confirm the version has been bumped. As long as your version is at or above one of the secure releases listed above, you are protected against CVE-2026-24765.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Secure Your Environments","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Secure Your Environments","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because PHPUnit lives in the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"require-dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"block of your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", this vulnerability does not impact your production environment—","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"provided you are deploying correctly","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Always build your production environment using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer install --no-dev --optimize-autoloader","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". This ensures testing frameworks are completely excluded from your live servers.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"For your CI/CD pipelines, ensure you are using ephemeral runners (runners that spin up fresh for every job and are destroyed afterward) so that an attacker cannot leave a malicious","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file behind for a subsequent test run to execute.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Would you like me to walk you through how to verify that your production server is completely free of development dependencies?","depth":24,"bounds":{"left":0.08959442,"top":0.0,"width":0.11502659,"height":0.057861134},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.086269945,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.09690824,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.107546546,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.11818484,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.12882313,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.1022274,"top":0.045889866,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.116855055,"top":0.045889866,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said root@docker_lamp_1:/home/jiminny# composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText homepage : https://phpunit.de/ source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00 dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00 path : /home/jiminny/vendor/phpunit/phpunit names : phpunit/phpunit support issues : https://github.com/sebastianbergmann/phpunit/issues security : https://github.com/sebastianbergmann/phpunit/security/policy source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55 autoload files classmap src/ requires ext-dom * ext-json * ext-libxml * ext-mbstring * ext-xml * ext-xmlwriter * myclabs/deep-copy ^1.13.4 phar-io/manifest ^2.0.4 phar-io/version ^3.2.1 php >=8.2 phpunit/php-code-coverage ^11.0.12 phpunit/php-file-iterator ^5.1.1 phpunit/php-invoker ^5.0.1 phpunit/php-text-template ^4.0.1 phpunit/php-timer ^7.0.1 sebastian/cli-parser ^3.0.2 sebastian/code-unit ^3.0.3 sebastian/comparator ^6.3.3 sebastian/diff ^6.0.2 sebastian/environment ^7.2.1 sebastian/exporter ^6.3.2 sebastian/global-state ^7.0.2 sebastian/object-enumerator ^6.0.1 sebastian/recursion-context ^6.0.3 sebastian/type ^5.1.3 sebastian/version ^5.0.2 staabm/side-effects-detector ^1.0.5 suggests ext-soap To be able to generate mocks based on WSDL files","depth":21,"bounds":{"left":0.13680187,"top":0.05546688,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.079288565,"top":0.056264963,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"root@docker_lamp_1:/home/jiminny# composer show phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.057063047,"width":0.051363032,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"name : phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.13367917,"width":0.04305186,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"descrip. : The PHP Unit Testing framework.","depth":23,"bounds":{"left":0.13680187,"top":0.1528332,"width":0.044049203,"height":0.054668795},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"keywords : phpunit, testing, xunit","depth":23,"bounds":{"left":0.13680187,"top":0.21029529,"width":0.046875,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions : * 11.5.55","depth":23,"bounds":{"left":0.13680187,"top":0.24860336,"width":0.04338431,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"type : library","depth":23,"bounds":{"left":0.13680187,"top":0.2677574,"width":0.035738032,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"license : BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText","depth":23,"bounds":{"left":0.13680187,"top":0.2869114,"width":0.051529255,"height":0.16959298},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"homepage : https://phpunit.de/","depth":23,"bounds":{"left":0.13680187,"top":0.4592977,"width":0.046875,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00","depth":23,"bounds":{"left":0.13680187,"top":0.49760574,"width":0.051529255,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00","depth":23,"bounds":{"left":0.13680187,"top":0.63168395,"width":0.051030584,"height":0.20790103},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"path : /home/jiminny/vendor/phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.8423783,"width":0.03856383,"height":0.054668795},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"names : phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.89984035,"width":0.044215426,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"support","depth":23,"bounds":{"left":0.13680187,"top":0.95730245,"width":0.018949468,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"issues : https://github.com/sebastianbergmann/phpunit/issues","depth":23,"bounds":{"left":0.13680187,"top":0.9764565,"width":0.049534574,"height":0.023543477},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"security : https://github.com/sebastianbergmann/phpunit/security/policy","depth":23,"bounds":{"left":0.13680187,"top":1.0,"width":0.049534574,"height":-0.05307257},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"autoload","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"classmap","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"src/","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"requires","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-dom *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-json *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-libxml *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-mbstring *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-xml *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-xmlwriter *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"myclabs/deep-copy ^1.13.4","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phar-io/manifest ^2.0.4","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phar-io/version ^3.2.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php >=8.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-code-coverage ^11.0.12","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-file-iterator ^5.1.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-invoker ^5.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-text-template ^4.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-timer ^7.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/cli-parser ^3.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/code-unit ^3.0.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/comparator ^6.3.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/diff ^6.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/environment ^7.2.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/exporter ^6.3.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/global-state ^7.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/object-enumerator ^6.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/recursion-context ^6.0.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/type ^5.1.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/version ^5.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"staabm/side-effects-detector ^1.0.5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"suggests","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-soap To be able to generate mocks based on WSDL files","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.18866356,"top":0.05546688,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.1939827,"top":0.18316041,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.10289229,"top":0.18555467,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.10056516,"top":0.22705507,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.10056516,"top":0.22905028,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Assessment: Safe","depth":23,"bounds":{"left":0.08959442,"top":0.22785315,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Assessment: Safe","depth":24,"bounds":{"left":0.08959442,"top":0.22944932,"width":0.045711435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Based on the terminal output you provided, your Laravel project is","depth":24,"bounds":{"left":0.08959442,"top":0.25578612,"width":0.105884306,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not vulnerable","depth":24,"bounds":{"left":0.14428191,"top":0.27653632,"width":0.03756649,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CVE-2026-24765.","depth":24,"bounds":{"left":0.08959442,"top":0.27653632,"width":0.099734046,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Your Installed Version:","depth":26,"bounds":{"left":0.1022274,"top":0.32681563,"width":0.057347074,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.55","depth":27,"bounds":{"left":0.16289894,"top":0.32801276,"width":0.019614361,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Secure Patched Version:","depth":26,"bounds":{"left":0.1022274,"top":0.35634476,"width":0.062832445,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.50","depth":27,"bounds":{"left":0.16855054,"top":0.3575419,"width":0.019448139,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(for the 11.x release branch)","depth":26,"bounds":{"left":0.1022274,"top":0.35634476,"width":0.09923537,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because you are running","depth":24,"bounds":{"left":0.08959442,"top":0.41061452,"width":0.061170213,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.55","depth":25,"bounds":{"left":0.15275931,"top":0.41181165,"width":0.019614361,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is newer than the required security patch, the unsafe deserialization flaw in the","depth":24,"bounds":{"left":0.08959442,"top":0.41061452,"width":0.108211435,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":25,"bounds":{"left":0.09158909,"top":0.47406226,"width":0.055851065,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.","depth":24,"bounds":{"left":0.08959442,"top":0.47286513,"width":0.11037234,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A quick reminder on best practices:","depth":24,"bounds":{"left":0.08959442,"top":0.5718276,"width":0.09225399,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Since you are running this inside a Docker container (","depth":24,"bounds":{"left":0.08959442,"top":0.5925778,"width":0.1022274,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker_lamp_1","depth":25,"bounds":{"left":0.11768617,"top":0.61452514,"width":0.036402926,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), just ensure that when you build your production container images, you continue to use the","depth":24,"bounds":{"left":0.08959442,"top":0.61332804,"width":0.1100399,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"--no-dev","depth":25,"bounds":{"left":0.1697141,"top":0.6560255,"width":0.022273935,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.","depth":24,"bounds":{"left":0.08959442,"top":0.6548284,"width":0.11502659,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":21,"bounds":{"left":0.086269945,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":21,"bounds":{"left":0.09690824,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Redo","depth":21,"bounds":{"left":0.107546546,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Share & export","depth":20,"bounds":{"left":0.11818484,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":21,"bounds":{"left":0.12882313,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":20,"bounds":{"left":0.13946144,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXTextArea","text":"Enter a prompt for Gemini\nencrypted","depth":20,"bounds":{"left":0.09291888,"top":0.8216281,"width":0.10638298,"height":0.01915403},"on_screen":true,"value":"Enter a prompt for Gemini\nencrypted","help_text":"","role_description":"text entry area","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Enter a prompt for Gemini","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"encrypted","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open upload file menu","depth":20,"bounds":{"left":0.08892952,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Tools","depth":18,"bounds":{"left":0.10488697,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Open mode picker","depth":20,"bounds":{"left":0.1619016,"top":0.85514766,"width":0.026097074,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Pro","depth":23,"bounds":{"left":0.16722074,"top":0.8639266,"width":0.007480053,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Microphone","depth":19,"bounds":{"left":0.18999335,"top":0.85514766,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Send message","depth":19,"bounds":{"left":0.19630983,"top":0.85434955,"width":0.013962766,"height":0.033519555},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":false,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.","depth":17,"bounds":{"left":0.08510638,"top":0.90901834,"width":0.11951463,"height":0.025139665},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Your privacy & Gemini Opens in a new window","depth":17,"bounds":{"left":0.16705452,"top":0.92178774,"width":0.040059842,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Your privacy & Gemini","depth":18,"bounds":{"left":0.16705452,"top":0.92178774,"width":0.040059842,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-6148799641436889898
|
-2648118846120706174
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit
name : phpunit/phpunit
descrip. : The PHP Unit Testing framework.
keywords : phpunit, testing, xunit
versions : * 11.5.55
type : library
license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText
homepage : https://phpunit.de/
source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00
dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00
path : /home/jiminny/vendor/phpunit/phpunit
names : phpunit/phpunit
support
issues : https://github.com/sebastianbergmann/phpunit/issues
security : https://github.com/sebastianbergmann/phpunit/security/policy
source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55
autoload
files
classmap
src/
requires
ext-dom *
ext-json *
ext-libxml *
ext-mbstring *
ext-xml *
ext-xmlwriter *
myclabs/deep-copy ^1.13.4
phar-io/manifest ^2.0.4
phar-io/version ^3.2.1
php >=8.2
phpunit/php-code-coverage ^11.0.12
phpunit/php-file-iterator ^5.1.1
phpunit/php-invoker ^5.0.1
phpunit/php-text-template ^4.0.1
phpunit/php-timer ^7.0.1
sebastian/cli-parser ^3.0.2
sebastian/code-unit ^3.0.3
sebastian/comparator ^6.3.3
sebastian/diff ^6.0.2
sebastian/environment ^7.2.1
sebastian/exporter ^6.3.2
sebastian/global-state ^7.0.2
sebastian/object-enumerator ^6.0.1
sebastian/recursion-context ^6.0.3
sebastian/type ^5.1.3
sebastian/version ^5.0.2
staabm/side-effects-detector ^1.0.5
suggests
ext-soap To be able to generate mocks based on WSDL files
Expand
Listen
Show thinking
Gemini said
Gemini said
Assessment: Safe
Assessment: Safe
Based on the terminal output you provided, your Laravel project is
not vulnerable
to CVE-2026-24765.
Your Installed Version:
11.5.55
Secure Patched Version:
11.5.50
(for the 11.x release branch)
Because you are running
11.5.55
, which is newer than the required security patch, the unsafe deserialization flaw in the
cleanupForCoverage()
method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.
A quick reminder on best practices:
Since you are running this inside a Docker container (
docker_lamp_1
), just ensure that when you build your production container images, you continue to use the
--no-dev
flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini...
|
32935
|
NULL
|
NULL
|
NULL
|
|
32939
|
1258
|
9
|
2026-05-13T09:51:52.452791+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665912452_m1.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
jiminny.atlassian.net/browse/JY-19957?search_id=d4 jiminny.atlassian.net/browse/JY-19957?search_id=d436a87d-f5b4-44e0-9541-4471b4b44c1c...
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-65522392466430207
|
-419197789539058558
|
click
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32940
|
1259
|
9
|
2026-05-13T09:51:52.440837+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665912440_m2.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
jiminny.atlassian.net/browse/JY-19957?search_id=d4 jiminny.atlassian.net/browse/JY-19957?search_id=d436a87d-f5b4-44e0-9541-4471b4b44c1c...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.5171588,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
1014651387812083006
|
-419197789572612986
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32941
|
1259
|
10
|
2026-05-13T09:51:55.446255+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665915446_m2.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
jiminny.atlassian.net/browse/JY-19957?search_id=d4 jiminny.atlassian.net/browse/JY-19957?search_id=d436a87d-f5b4-44e0-9541-4471b4b44c1c...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit
name : phpunit/phpunit
descrip. : The PHP Unit Testing framework.
keywords : phpunit, testing, xunit
versions : * 11.5.55
type : library
license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText
homepage : https://phpunit.de/
source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00
dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00
path : /home/jiminny/vendor/phpunit/phpunit
names : phpunit/phpunit
support
issues : https://github.com/sebastianbergmann/phpunit/issues
security : https://github.com/sebastianbergmann/phpunit/security/policy
source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55
autoload
files
classmap
src/
requires
ext-dom *
ext-json *
ext-libxml *
ext-mbstring *
ext-xml *
ext-xmlwriter *
myclabs/deep-copy ^1.13.4
phar-io/manifest ^2.0.4
phar-io/version ^3.2.1
php >=8.2
phpunit/php-code-coverage ^11.0.12
phpunit/php-file-iterator ^5.1.1
phpunit/php-invoker ^5.0.1
phpunit/php-text-template ^4.0.1
phpunit/php-timer ^7.0.1
sebastian/cli-parser ^3.0.2
sebastian/code-unit ^3.0.3
sebastian/comparator ^6.3.3
sebastian/diff ^6.0.2
sebastian/environment ^7.2.1
sebastian/exporter ^6.3.2
sebastian/global-state ^7.0.2
sebastian/object-enumerator ^6.0.1
sebastian/recursion-context ^6.0.3
sebastian/type ^5.1.3
sebastian/version ^5.0.2
staabm/side-effects-detector ^1.0.5
suggests
ext-soap To be able to generate mocks based on WSDL files
Expand
Listen
Show thinking
Gemini said
Gemini said
Assessment: Safe
Assessment: Safe
Based on the terminal output you provided, your Laravel project is
not vulnerable
to CVE-2026-24765.
Your Installed Version:
11.5.55
Secure Patched Version:
11.5.50
(for the 11.x release branch)
Because you are running
11.5.55
, which is newer than the required security patch, the unsafe deserialization flaw in the
cleanupForCoverage()
method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.
A quick reminder on best practices:
Since you are running this inside a Docker container (
docker_lamp_1
), just ensure that when you build your production container images, you continue to use the
--no-dev
flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to:
Sidebar
Sidebar
Top Bar
Top Bar
Main Content
Main Content
Collapse sidebar [
Collapse sidebar [
Switch sites or apps
Switch sites or apps
Go to your Jira homepage
Upgrade
Upgrade
Create
Create
Rovo Ask Rovo
Ask Rovo
8 Notifications
8 Notifications
Help
Help
Settings
Settings
[EMAIL]
[EMAIL]
For you
For you
Recent
Recent
Starred
Starred
Apps
Apps
More actions for Apps
More actions for Apps
Spaces
Spaces
Create space
Create space
More actions for spaces
More actions for spaces
Recent
Jiminny (New)
Jiminny (New)
Jiminny (New)
Create board
Create board
More actions for Jiminny (New)
More actions for Jiminny (New)
Platform Team
Platform Team
Board actions
Board actions
Capture Team
Capture Team
Board actions
Board actions
Enterprise Stability Issues 🤕
Enterprise Stability Issues 🤕
Board actions
Board actions...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.5171588,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"7.8 (High)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requirement:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Resolution and Mitigation","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Resolution and Mitigation","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Official Patch:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The maintainer updated PHPUnit to treat pre-existing","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files as an error condition rather than attempting to sanitize and process them.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Recommended Actions:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"* Update PHPUnit to the latest patched version in your respective release branch.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Enforce code reviews and branch protection to prevent malicious file injection.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I fix these vulnareabilities in laravel project","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I fix these vulnareabilities in laravel project","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly how to secure your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check Your Current Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check Your Current Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer show phpunit/phpunit","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Look at the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"line in the output to see if you are running a vulnerable version (anything lower than 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Update PHPUnit","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Update PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tell Composer to update PHPUnit and its associated dependencies to the latest secure versions allowed by your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"constraints:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer update phpunit/phpunit --with-dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Note: If your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"restricts PHPUnit to an older major version (like","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"^9.0","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), Composer will automatically grab the secure patch for that specific major version (e.g., 9.6.33).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Verify the Fix","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Verify the Fix","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer show","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"command from step one again to confirm the version has been bumped. As long as your version is at or above one of the secure releases listed above, you are protected against CVE-2026-24765.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Secure Your Environments","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Secure Your Environments","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because PHPUnit lives in the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"require-dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"block of your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", this vulnerability does not impact your production environment—","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"provided you are deploying correctly","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Always build your production environment using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer install --no-dev --optimize-autoloader","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". This ensures testing frameworks are completely excluded from your live servers.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"For your CI/CD pipelines, ensure you are using ephemeral runners (runners that spin up fresh for every job and are destroyed afterward) so that an attacker cannot leave a malicious","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file behind for a subsequent test run to execute.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Would you like me to walk you through how to verify that your production server is completely free of development dependencies?","depth":24,"bounds":{"left":0.08959442,"top":0.0,"width":0.11502659,"height":0.057861134},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.086269945,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.09690824,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.107546546,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.11818484,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.12882313,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.1022274,"top":0.045889866,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.116855055,"top":0.045889866,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said root@docker_lamp_1:/home/jiminny# composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText homepage : https://phpunit.de/ source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00 dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00 path : /home/jiminny/vendor/phpunit/phpunit names : phpunit/phpunit support issues : https://github.com/sebastianbergmann/phpunit/issues security : https://github.com/sebastianbergmann/phpunit/security/policy source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55 autoload files classmap src/ requires ext-dom * ext-json * ext-libxml * ext-mbstring * ext-xml * ext-xmlwriter * myclabs/deep-copy ^1.13.4 phar-io/manifest ^2.0.4 phar-io/version ^3.2.1 php >=8.2 phpunit/php-code-coverage ^11.0.12 phpunit/php-file-iterator ^5.1.1 phpunit/php-invoker ^5.0.1 phpunit/php-text-template ^4.0.1 phpunit/php-timer ^7.0.1 sebastian/cli-parser ^3.0.2 sebastian/code-unit ^3.0.3 sebastian/comparator ^6.3.3 sebastian/diff ^6.0.2 sebastian/environment ^7.2.1 sebastian/exporter ^6.3.2 sebastian/global-state ^7.0.2 sebastian/object-enumerator ^6.0.1 sebastian/recursion-context ^6.0.3 sebastian/type ^5.1.3 sebastian/version ^5.0.2 staabm/side-effects-detector ^1.0.5 suggests ext-soap To be able to generate mocks based on WSDL files","depth":21,"bounds":{"left":0.13680187,"top":0.05546688,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.079288565,"top":0.056264963,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"root@docker_lamp_1:/home/jiminny# composer show phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.057063047,"width":0.051363032,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"name : phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.13367917,"width":0.04305186,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"descrip. : The PHP Unit Testing framework.","depth":23,"bounds":{"left":0.13680187,"top":0.1528332,"width":0.044049203,"height":0.054668795},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"keywords : phpunit, testing, xunit","depth":23,"bounds":{"left":0.13680187,"top":0.21029529,"width":0.046875,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions : * 11.5.55","depth":23,"bounds":{"left":0.13680187,"top":0.24860336,"width":0.04338431,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"type : library","depth":23,"bounds":{"left":0.13680187,"top":0.2677574,"width":0.035738032,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"license : BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText","depth":23,"bounds":{"left":0.13680187,"top":0.2869114,"width":0.051529255,"height":0.16959298},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"homepage : https://phpunit.de/","depth":23,"bounds":{"left":0.13680187,"top":0.4592977,"width":0.046875,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00","depth":23,"bounds":{"left":0.13680187,"top":0.49760574,"width":0.051529255,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00","depth":23,"bounds":{"left":0.13680187,"top":0.63168395,"width":0.051030584,"height":0.20790103},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"path : /home/jiminny/vendor/phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.8423783,"width":0.03856383,"height":0.054668795},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"names : phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.89984035,"width":0.044215426,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"support","depth":23,"bounds":{"left":0.13680187,"top":0.95730245,"width":0.018949468,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"issues : https://github.com/sebastianbergmann/phpunit/issues","depth":23,"bounds":{"left":0.13680187,"top":0.9764565,"width":0.049534574,"height":0.023543477},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"security : https://github.com/sebastianbergmann/phpunit/security/policy","depth":23,"bounds":{"left":0.13680187,"top":1.0,"width":0.049534574,"height":-0.05307257},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"autoload","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"classmap","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"src/","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"requires","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-dom *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-json *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-libxml *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-mbstring *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-xml *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-xmlwriter *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"myclabs/deep-copy ^1.13.4","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phar-io/manifest ^2.0.4","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phar-io/version ^3.2.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php >=8.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-code-coverage ^11.0.12","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-file-iterator ^5.1.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-invoker ^5.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-text-template ^4.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-timer ^7.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/cli-parser ^3.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/code-unit ^3.0.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/comparator ^6.3.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/diff ^6.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/environment ^7.2.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/exporter ^6.3.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/global-state ^7.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/object-enumerator ^6.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/recursion-context ^6.0.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/type ^5.1.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/version ^5.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"staabm/side-effects-detector ^1.0.5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"suggests","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-soap To be able to generate mocks based on WSDL files","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.18866356,"top":0.05546688,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.1939827,"top":0.18316041,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.10289229,"top":0.18555467,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.10056516,"top":0.22705507,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.10056516,"top":0.22905028,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Assessment: Safe","depth":23,"bounds":{"left":0.08959442,"top":0.22785315,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Assessment: Safe","depth":24,"bounds":{"left":0.08959442,"top":0.22944932,"width":0.045711435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Based on the terminal output you provided, your Laravel project is","depth":24,"bounds":{"left":0.08959442,"top":0.25578612,"width":0.105884306,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not vulnerable","depth":24,"bounds":{"left":0.14428191,"top":0.27653632,"width":0.03756649,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CVE-2026-24765.","depth":24,"bounds":{"left":0.08959442,"top":0.27653632,"width":0.099734046,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Your Installed Version:","depth":26,"bounds":{"left":0.1022274,"top":0.32681563,"width":0.057347074,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.55","depth":27,"bounds":{"left":0.16289894,"top":0.32801276,"width":0.019614361,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Secure Patched Version:","depth":26,"bounds":{"left":0.1022274,"top":0.35634476,"width":0.062832445,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.50","depth":27,"bounds":{"left":0.16855054,"top":0.3575419,"width":0.019448139,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(for the 11.x release branch)","depth":26,"bounds":{"left":0.1022274,"top":0.35634476,"width":0.09923537,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because you are running","depth":24,"bounds":{"left":0.08959442,"top":0.41061452,"width":0.061170213,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.55","depth":25,"bounds":{"left":0.15275931,"top":0.41181165,"width":0.019614361,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is newer than the required security patch, the unsafe deserialization flaw in the","depth":24,"bounds":{"left":0.08959442,"top":0.41061452,"width":0.108211435,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":25,"bounds":{"left":0.09158909,"top":0.47406226,"width":0.055851065,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.","depth":24,"bounds":{"left":0.08959442,"top":0.47286513,"width":0.11037234,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A quick reminder on best practices:","depth":24,"bounds":{"left":0.08959442,"top":0.5718276,"width":0.09225399,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Since you are running this inside a Docker container (","depth":24,"bounds":{"left":0.08959442,"top":0.5925778,"width":0.1022274,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker_lamp_1","depth":25,"bounds":{"left":0.11768617,"top":0.61452514,"width":0.036402926,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), just ensure that when you build your production container images, you continue to use the","depth":24,"bounds":{"left":0.08959442,"top":0.61332804,"width":0.1100399,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"--no-dev","depth":25,"bounds":{"left":0.1697141,"top":0.6560255,"width":0.022273935,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.","depth":24,"bounds":{"left":0.08959442,"top":0.6548284,"width":0.11502659,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":21,"bounds":{"left":0.086269945,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":21,"bounds":{"left":0.09690824,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Redo","depth":21,"bounds":{"left":0.107546546,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Share & export","depth":20,"bounds":{"left":0.11818484,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":21,"bounds":{"left":0.12882313,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":20,"bounds":{"left":0.13946144,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXTextArea","text":"Enter a prompt for Gemini\nencrypted","depth":20,"bounds":{"left":0.09291888,"top":0.8216281,"width":0.10638298,"height":0.01915403},"on_screen":true,"value":"Enter a prompt for Gemini\nencrypted","help_text":"","role_description":"text entry area","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Enter a prompt for Gemini","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"encrypted","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open upload file menu","depth":20,"bounds":{"left":0.08892952,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Tools","depth":18,"bounds":{"left":0.10488697,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Open mode picker","depth":20,"bounds":{"left":0.1619016,"top":0.85514766,"width":0.026097074,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Pro","depth":23,"bounds":{"left":0.16722074,"top":0.8639266,"width":0.007480053,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Microphone","depth":19,"bounds":{"left":0.18999335,"top":0.85514766,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Send message","depth":19,"bounds":{"left":0.19630983,"top":0.85434955,"width":0.013962766,"height":0.033519555},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":false,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.","depth":17,"bounds":{"left":0.08510638,"top":0.90901834,"width":0.11951463,"height":0.025139665},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Your privacy & Gemini Opens in a new window","depth":17,"bounds":{"left":0.16705452,"top":0.92178774,"width":0.040059842,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Your privacy & Gemini","depth":18,"bounds":{"left":0.16705452,"top":0.92178774,"width":0.040059842,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Opens in a new window","depth":19,"bounds":{"left":0.079288565,"top":0.92098963,"width":0.043218084,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Summarize page","depth":7,"bounds":{"left":0.08494016,"top":0.95730245,"width":0.053523935,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Summarize page","depth":9,"bounds":{"left":0.09059176,"top":0.96249,"width":0.042220745,"height":0.015163607},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Skip to:","depth":9,"bounds":{"left":0.22606383,"top":0.07861133,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Sidebar","depth":10,"bounds":{"left":0.22606383,"top":0.097765364,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Sidebar","depth":11,"bounds":{"left":0.22606383,"top":0.097765364,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Top Bar","depth":10,"bounds":{"left":0.22606383,"top":0.11691939,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Top Bar","depth":11,"bounds":{"left":0.22606383,"top":0.11691939,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Main Content","depth":10,"bounds":{"left":0.22606383,"top":0.13607343,"width":0.029421542,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Main Content","depth":11,"bounds":{"left":0.22606383,"top":0.13607343,"width":0.029421542,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Collapse sidebar [","depth":9,"bounds":{"left":0.21941489,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Collapse sidebar [","depth":11,"bounds":{"left":0.22456782,"top":0.06344773,"width":0.039727394,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Switch sites or apps","depth":10,"bounds":{"left":0.23138298,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Switch sites or apps","depth":12,"bounds":{"left":0.2365359,"top":0.06344773,"width":0.044215426,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Go to your Jira homepage","depth":9,"bounds":{"left":0.24468085,"top":0.057861134,"width":0.029421542,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXComboBox","text":"Upgrade","depth":11,"bounds":{"left":0.47273937,"top":0.06264964,"width":0.24268617,"height":0.015961692},"on_screen":true,"value":"Upgrade","help_text":"","placeholder":"Search","role_description":"combo box","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Upgrade","depth":12,"bounds":{"left":0.47273937,"top":0.06384677,"width":0.019115692,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Create","depth":10,"bounds":{"left":0.7237367,"top":0.057861134,"width":0.030086435,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Create","depth":12,"bounds":{"left":0.7350399,"top":0.06384677,"width":0.014793883,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Rovo Ask Rovo","depth":12,"bounds":{"left":0.91240025,"top":0.057861134,"width":0.035904255,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Ask Rovo","depth":14,"bounds":{"left":0.92370343,"top":0.06384677,"width":0.020611702,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"8 Notifications","depth":12,"bounds":{"left":0.9496343,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"8 Notifications","depth":14,"bounds":{"left":0.95478725,"top":0.06344773,"width":0.031914894,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Help","depth":12,"bounds":{"left":0.9616024,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Help","depth":14,"bounds":{"left":0.96675533,"top":0.06344773,"width":0.010139627,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Settings","depth":12,"bounds":{"left":0.97357047,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Settings","depth":14,"bounds":{"left":0.9787234,"top":0.06344773,"width":0.017952127,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.98553854,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"lukas.kovalik@jiminny.com","depth":14,"bounds":{"left":0.9906915,"top":0.06344773,"width":0.009308517,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"For you","depth":12,"bounds":{"left":0.21941489,"top":0.09976058,"width":0.071476065,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"For you","depth":15,"bounds":{"left":0.23005319,"top":0.10574621,"width":0.01662234,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Recent","depth":12,"bounds":{"left":0.21941489,"top":0.12529927,"width":0.071476065,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Recent","depth":15,"bounds":{"left":0.23005319,"top":0.13128492,"width":0.015458777,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Starred","depth":12,"bounds":{"left":0.21941489,"top":0.15083799,"width":0.071476065,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Starred","depth":15,"bounds":{"left":0.23005319,"top":0.15682362,"width":0.016456118,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Apps","depth":12,"bounds":{"left":0.21941489,"top":0.1763767,"width":0.071476065,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Apps","depth":15,"bounds":{"left":0.23005319,"top":0.18236233,"width":0.011635638,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"More actions for Apps","depth":13,"bounds":{"left":0.28889626,"top":0.17956904,"width":0.0039893617,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"More actions for Apps","depth":15,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Spaces","depth":12,"bounds":{"left":0.21941489,"top":0.2019154,"width":0.071476065,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXStaticText","text":"Spaces","depth":15,"bounds":{"left":0.23005319,"top":0.20790103,"width":0.016456118,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Create space","depth":13,"bounds":{"left":0.27227393,"top":0.20510775,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Create space","depth":15,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"More actions for spaces","depth":13,"bounds":{"left":0.28158244,"top":0.20510775,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"More actions for spaces","depth":15,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Recent","depth":16,"bounds":{"left":0.22539894,"top":0.23423783,"width":0.013464096,"height":0.011971269},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Jiminny (New)","depth":17,"bounds":{"left":0.22340426,"top":0.2529928,"width":0.0674867,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Jiminny (New)","depth":20,"bounds":{"left":0.23404256,"top":0.25897846,"width":0.032081116,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Jiminny (New)","depth":18,"bounds":{"left":0.22473404,"top":0.25618514,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXMenuButton","text":"Create board","depth":18,"bounds":{"left":0.27227393,"top":0.25618514,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Create board","depth":20,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"More actions for Jiminny (New)","depth":18,"bounds":{"left":0.28158244,"top":0.25618514,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"More actions for Jiminny (New)","depth":20,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Platform Team","depth":19,"bounds":{"left":0.22739361,"top":0.27853152,"width":0.06349734,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Team","depth":22,"bounds":{"left":0.23803191,"top":0.28451717,"width":0.032247342,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Board actions","depth":20,"bounds":{"left":0.28889626,"top":0.28172386,"width":0.0039893617,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Board actions","depth":22,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Capture Team","depth":19,"bounds":{"left":0.22739361,"top":0.30407023,"width":0.06349734,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Capture Team","depth":22,"bounds":{"left":0.23803191,"top":0.31005585,"width":0.03125,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Board actions","depth":20,"bounds":{"left":0.28889626,"top":0.30726257,"width":0.0039893617,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Board actions","depth":22,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Enterprise Stability Issues 🤕","depth":19,"bounds":{"left":0.22739361,"top":0.32960895,"width":0.06349734,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Enterprise Stability Issues 🤕","depth":22,"bounds":{"left":0.23803191,"top":0.33559456,"width":0.050531916,"height":0.030726258},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Board actions","depth":20,"bounds":{"left":0.28889626,"top":0.33280128,"width":0.0039893617,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Board actions","depth":22,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-9117016883861102029
|
-2657126114094924158
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit
name : phpunit/phpunit
descrip. : The PHP Unit Testing framework.
keywords : phpunit, testing, xunit
versions : * 11.5.55
type : library
license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText
homepage : https://phpunit.de/
source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00
dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00
path : /home/jiminny/vendor/phpunit/phpunit
names : phpunit/phpunit
support
issues : https://github.com/sebastianbergmann/phpunit/issues
security : https://github.com/sebastianbergmann/phpunit/security/policy
source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55
autoload
files
classmap
src/
requires
ext-dom *
ext-json *
ext-libxml *
ext-mbstring *
ext-xml *
ext-xmlwriter *
myclabs/deep-copy ^1.13.4
phar-io/manifest ^2.0.4
phar-io/version ^3.2.1
php >=8.2
phpunit/php-code-coverage ^11.0.12
phpunit/php-file-iterator ^5.1.1
phpunit/php-invoker ^5.0.1
phpunit/php-text-template ^4.0.1
phpunit/php-timer ^7.0.1
sebastian/cli-parser ^3.0.2
sebastian/code-unit ^3.0.3
sebastian/comparator ^6.3.3
sebastian/diff ^6.0.2
sebastian/environment ^7.2.1
sebastian/exporter ^6.3.2
sebastian/global-state ^7.0.2
sebastian/object-enumerator ^6.0.1
sebastian/recursion-context ^6.0.3
sebastian/type ^5.1.3
sebastian/version ^5.0.2
staabm/side-effects-detector ^1.0.5
suggests
ext-soap To be able to generate mocks based on WSDL files
Expand
Listen
Show thinking
Gemini said
Gemini said
Assessment: Safe
Assessment: Safe
Based on the terminal output you provided, your Laravel project is
not vulnerable
to CVE-2026-24765.
Your Installed Version:
11.5.55
Secure Patched Version:
11.5.50
(for the 11.x release branch)
Because you are running
11.5.55
, which is newer than the required security patch, the unsafe deserialization flaw in the
cleanupForCoverage()
method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.
A quick reminder on best practices:
Since you are running this inside a Docker container (
docker_lamp_1
), just ensure that when you build your production container images, you continue to use the
--no-dev
flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to:
Sidebar
Sidebar
Top Bar
Top Bar
Main Content
Main Content
Collapse sidebar [
Collapse sidebar [
Switch sites or apps
Switch sites or apps
Go to your Jira homepage
Upgrade
Upgrade
Create
Create
Rovo Ask Rovo
Ask Rovo
8 Notifications
8 Notifications
Help
Help
Settings
Settings
[EMAIL]
[EMAIL]
For you
For you
Recent
Recent
Starred
Starred
Apps
Apps
More actions for Apps
More actions for Apps
Spaces
Spaces
Create space
Create space
More actions for spaces
More actions for spaces
Recent
Jiminny (New)
Jiminny (New)
Jiminny (New)
Create board
Create board
More actions for Jiminny (New)
More actions for Jiminny (New)
Platform Team
Platform Team
Board actions
Board actions
Capture Team
Capture Team
Board actions
Board actions
Enterprise Stability Issues 🤕
Enterprise Stability Issues 🤕
Board actions
Board actions...
|
32940
|
NULL
|
NULL
|
NULL
|
|
32942
|
1259
|
11
|
2026-05-13T09:51:58.453139+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665918453_m2.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
jiminny.atlassian.net/browse/JY-19957?search_id=d4 jiminny.atlassian.net/browse/JY-19957?search_id=d436a87d-f5b4-44e0-9541-4471b4b44c1c...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.5171588,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-6188673044869339695
|
-418916178197136250
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32943
|
1258
|
10
|
2026-05-13T09:52:01.137941+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665921137_m1.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
jiminny.atlassian.net/browse/JY-19957?search_id=d4 jiminny.atlassian.net/browse/JY-19957?search_id=d436a87d-f5b4-44e0-9541-4471b4b44c1c...
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment
Risk Assessment
CVSS Score:
7.8 (High)
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requirement:
Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.
Resolution and Mitigation
Resolution and Mitigation
Official Patch:
The maintainer updated PHPUnit to treat pre-existing
.coverage
files as an error condition rather than attempting to sanitize and process them.
Recommended Actions:
* Update PHPUnit to the latest patched version in your respective release branch.
Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.
Enforce code reviews and branch protection to prevent malicious file injection.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I fix these vulnareabilities in laravel project
You said
how can I fix these vulnareabilities in laravel project
Listen
Show thinking...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"7.8 (High)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requirement:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Resolution and Mitigation","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Resolution and Mitigation","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Official Patch:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The maintainer updated PHPUnit to treat pre-existing","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files as an error condition rather than attempting to sanitize and process them.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Recommended Actions:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"* Update PHPUnit to the latest patched version in your respective release branch.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Enforce code reviews and branch protection to prevent malicious file injection.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I fix these vulnareabilities in laravel project","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I fix these vulnareabilities in laravel project","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-4555978764236932482
|
-130685939491717498
|
click
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment
Risk Assessment
CVSS Score:
7.8 (High)
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requirement:
Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.
Resolution and Mitigation
Resolution and Mitigation
Official Patch:
The maintainer updated PHPUnit to treat pre-existing
.coverage
files as an error condition rather than attempting to sanitize and process them.
Recommended Actions:
* Update PHPUnit to the latest patched version in your respective release branch.
Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.
Enforce code reviews and branch protection to prevent malicious file injection.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I fix these vulnareabilities in laravel project
You said
how can I fix these vulnareabilities in laravel project
Listen
Show thinking...
|
32939
|
NULL
|
NULL
|
NULL
|
|
32944
|
1259
|
12
|
2026-05-13T09:52:01.164932+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665921164_m2.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
jiminny.atlassian.net/browse/JY-19957?search_id=d4 jiminny.atlassian.net/browse/JY-19957?search_id=d436a87d-f5b4-44e0-9541-4471b4b44c1c...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment
Risk Assessment
CVSS Score:
7.8 (High)
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requirement:
Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.
Resolution and Mitigation
Resolution and Mitigation
Official Patch:
The maintainer updated PHPUnit to treat pre-existing
.coverage
files as an error condition rather than attempting to sanitize and process them.
Recommended Actions:
* Update PHPUnit to the latest patched version in your respective release branch.
Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.
Enforce code reviews and branch protection to prevent malicious file injection.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I fix these vulnareabilities in laravel project
You said
how can I fix these vulnareabilities in laravel project
Listen
Show thinking
Gemini said
Gemini said
Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.
Here is exactly how to secure your project:
1. Check Your Current Version
1. Check Your Current Version
First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:
Bash
Download code
Copy code
composer show phpunit/phpunit
Look at the
versions...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.5171588,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"7.8 (High)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requirement:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Resolution and Mitigation","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Resolution and Mitigation","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Official Patch:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The maintainer updated PHPUnit to treat pre-existing","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files as an error condition rather than attempting to sanitize and process them.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Recommended Actions:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"* Update PHPUnit to the latest patched version in your respective release branch.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Enforce code reviews and branch protection to prevent malicious file injection.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I fix these vulnareabilities in laravel project","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I fix these vulnareabilities in laravel project","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly how to secure your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check Your Current Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check Your Current Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer show phpunit/phpunit","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Look at the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
5416564539854306670
|
-418916315677245818
|
click
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment
Risk Assessment
CVSS Score:
7.8 (High)
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requirement:
Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.
Resolution and Mitigation
Resolution and Mitigation
Official Patch:
The maintainer updated PHPUnit to treat pre-existing
.coverage
files as an error condition rather than attempting to sanitize and process them.
Recommended Actions:
* Update PHPUnit to the latest patched version in your respective release branch.
Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.
Enforce code reviews and branch protection to prevent malicious file injection.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I fix these vulnareabilities in laravel project
You said
how can I fix these vulnareabilities in laravel project
Listen
Show thinking
Gemini said
Gemini said
Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.
Here is exactly how to secure your project:
1. Check Your Current Version
1. Check Your Current Version
First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:
Bash
Download code
Copy code
composer show phpunit/phpunit
Look at the
versions...
|
32942
|
NULL
|
NULL
|
NULL
|
|
32945
|
1259
|
13
|
2026-05-13T09:52:01.796772+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665921796_m2.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
jiminny.atlassian.net/browse/JY-19957?search_id=d4 jiminny.atlassian.net/browse/JY-19957?search_id=d436a87d-f5b4-44e0-9541-4471b4b44c1c...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit
name : phpunit/phpunit
descrip. : The PHP Unit Testing framework.
keywords : phpunit, testing, xunit
versions : * 11.5.55
type : library
license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText
homepage : https://phpunit.de/
source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00
dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00
path : /home/jiminny/vendor/phpunit/phpunit
names : phpunit/phpunit
support
issues : https://github.com/sebastianbergmann/phpunit/issues
security : https://github.com/sebastianbergmann/phpunit/security/policy
source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55
autoload
files
classmap
src/
requires
ext-dom *
ext-json *
ext-libxml *
ext-mbstring *
ext-xml *
ext-xmlwriter *
myclabs/deep-copy ^1.13.4
phar-io/manifest ^2.0.4
phar-io/version ^3.2.1
php >=8.2
phpunit/php-code-coverage ^11.0.12
phpunit/php-file-iterator ^5.1.1
phpunit/php-invoker ^5.0.1
phpunit/php-text-template ^4.0.1
phpunit/php-timer ^7.0.1
sebastian/cli-parser ^3.0.2
sebastian/code-unit ^3.0.3
sebastian/comparator ^6.3.3
sebastian/diff ^6.0.2
sebastian/environment ^7.2.1
sebastian/exporter ^6.3.2
sebastian/global-state ^7.0.2
sebastian/object-enumerator ^6.0.1
sebastian/recursion-context ^6.0.3
sebastian/type ^5.1.3
sebastian/version ^5.0.2
staabm/side-effects-detector ^1.0.5
suggests
ext-soap To be able to generate mocks based on WSDL files
Expand
Listen
Show thinking
Gemini said
Gemini said
Assessment: Safe
Assessment: Safe
Based on the terminal output you provided, your Laravel project is
not vulnerable
to CVE-2026-24765.
Your Installed Version:
11.5.55
Secure Patched Version:
11.5.50
(for the 11.x release branch)
Because you are running
11.5.55
, which is newer than the required security patch, the unsafe deserialization flaw in the
cleanupForCoverage()
method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.
A quick reminder on best practices:
Since you are running this inside a Docker container (
docker_lamp_1
), just ensure that when you build your production container images, you continue to use the
--no-dev
flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.
Good response
Bad response...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.5171588,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"7.8 (High)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requirement:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Resolution and Mitigation","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Resolution and Mitigation","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Official Patch:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The maintainer updated PHPUnit to treat pre-existing","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files as an error condition rather than attempting to sanitize and process them.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Recommended Actions:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"* Update PHPUnit to the latest patched version in your respective release branch.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Enforce code reviews and branch protection to prevent malicious file injection.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I fix these vulnareabilities in laravel project","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I fix these vulnareabilities in laravel project","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly how to secure your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check Your Current Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check Your Current Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer show phpunit/phpunit","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Look at the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"line in the output to see if you are running a vulnerable version (anything lower than 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Update PHPUnit","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Update PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tell Composer to update PHPUnit and its associated dependencies to the latest secure versions allowed by your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"constraints:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer update phpunit/phpunit --with-dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Note: If your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"restricts PHPUnit to an older major version (like","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"^9.0","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), Composer will automatically grab the secure patch for that specific major version (e.g., 9.6.33).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Verify the Fix","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Verify the Fix","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer show","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"command from step one again to confirm the version has been bumped. As long as your version is at or above one of the secure releases listed above, you are protected against CVE-2026-24765.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Secure Your Environments","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Secure Your Environments","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because PHPUnit lives in the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"require-dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"block of your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", this vulnerability does not impact your production environment—","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"provided you are deploying correctly","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Always build your production environment using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer install --no-dev --optimize-autoloader","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". This ensures testing frameworks are completely excluded from your live servers.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"For your CI/CD pipelines, ensure you are using ephemeral runners (runners that spin up fresh for every job and are destroyed afterward) so that an attacker cannot leave a malicious","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file behind for a subsequent test run to execute.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Would you like me to walk you through how to verify that your production server is completely free of development dependencies?","depth":24,"bounds":{"left":0.08959442,"top":0.0,"width":0.11502659,"height":0.057861134},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.086269945,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.09690824,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.107546546,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.11818484,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.12882313,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.1022274,"top":0.045889866,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.116855055,"top":0.045889866,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said root@docker_lamp_1:/home/jiminny# composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText homepage : https://phpunit.de/ source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00 dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00 path : /home/jiminny/vendor/phpunit/phpunit names : phpunit/phpunit support issues : https://github.com/sebastianbergmann/phpunit/issues security : https://github.com/sebastianbergmann/phpunit/security/policy source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55 autoload files classmap src/ requires ext-dom * ext-json * ext-libxml * ext-mbstring * ext-xml * ext-xmlwriter * myclabs/deep-copy ^1.13.4 phar-io/manifest ^2.0.4 phar-io/version ^3.2.1 php >=8.2 phpunit/php-code-coverage ^11.0.12 phpunit/php-file-iterator ^5.1.1 phpunit/php-invoker ^5.0.1 phpunit/php-text-template ^4.0.1 phpunit/php-timer ^7.0.1 sebastian/cli-parser ^3.0.2 sebastian/code-unit ^3.0.3 sebastian/comparator ^6.3.3 sebastian/diff ^6.0.2 sebastian/environment ^7.2.1 sebastian/exporter ^6.3.2 sebastian/global-state ^7.0.2 sebastian/object-enumerator ^6.0.1 sebastian/recursion-context ^6.0.3 sebastian/type ^5.1.3 sebastian/version ^5.0.2 staabm/side-effects-detector ^1.0.5 suggests ext-soap To be able to generate mocks based on WSDL files","depth":21,"bounds":{"left":0.13680187,"top":0.05546688,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.079288565,"top":0.056264963,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"root@docker_lamp_1:/home/jiminny# composer show phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.057063047,"width":0.051363032,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"name : phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.13367917,"width":0.04305186,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"descrip. : The PHP Unit Testing framework.","depth":23,"bounds":{"left":0.13680187,"top":0.1528332,"width":0.044049203,"height":0.054668795},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"keywords : phpunit, testing, xunit","depth":23,"bounds":{"left":0.13680187,"top":0.21029529,"width":0.046875,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions : * 11.5.55","depth":23,"bounds":{"left":0.13680187,"top":0.24860336,"width":0.04338431,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"type : library","depth":23,"bounds":{"left":0.13680187,"top":0.2677574,"width":0.035738032,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"license : BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText","depth":23,"bounds":{"left":0.13680187,"top":0.2869114,"width":0.051529255,"height":0.16959298},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"homepage : https://phpunit.de/","depth":23,"bounds":{"left":0.13680187,"top":0.4592977,"width":0.046875,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00","depth":23,"bounds":{"left":0.13680187,"top":0.49760574,"width":0.051529255,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00","depth":23,"bounds":{"left":0.13680187,"top":0.63168395,"width":0.051030584,"height":0.20790103},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"path : /home/jiminny/vendor/phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.8423783,"width":0.03856383,"height":0.054668795},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"names : phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.89984035,"width":0.044215426,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"support","depth":23,"bounds":{"left":0.13680187,"top":0.95730245,"width":0.018949468,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"issues : https://github.com/sebastianbergmann/phpunit/issues","depth":23,"bounds":{"left":0.13680187,"top":0.9764565,"width":0.049534574,"height":0.023543477},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"security : https://github.com/sebastianbergmann/phpunit/security/policy","depth":23,"bounds":{"left":0.13680187,"top":1.0,"width":0.049534574,"height":-0.05307257},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"autoload","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"classmap","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"src/","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"requires","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-dom *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-json *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-libxml *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-mbstring *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-xml *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-xmlwriter *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"myclabs/deep-copy ^1.13.4","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phar-io/manifest ^2.0.4","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phar-io/version ^3.2.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php >=8.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-code-coverage ^11.0.12","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-file-iterator ^5.1.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-invoker ^5.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-text-template ^4.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-timer ^7.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/cli-parser ^3.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/code-unit ^3.0.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/comparator ^6.3.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/diff ^6.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/environment ^7.2.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/exporter ^6.3.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/global-state ^7.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/object-enumerator ^6.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/recursion-context ^6.0.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/type ^5.1.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/version ^5.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"staabm/side-effects-detector ^1.0.5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"suggests","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-soap To be able to generate mocks based on WSDL files","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.18866356,"top":0.05546688,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.1939827,"top":0.18316041,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.10289229,"top":0.18555467,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.10056516,"top":0.22705507,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.10056516,"top":0.22905028,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Assessment: Safe","depth":23,"bounds":{"left":0.08959442,"top":0.22785315,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Assessment: Safe","depth":24,"bounds":{"left":0.08959442,"top":0.22944932,"width":0.045711435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Based on the terminal output you provided, your Laravel project is","depth":24,"bounds":{"left":0.08959442,"top":0.25578612,"width":0.105884306,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not vulnerable","depth":24,"bounds":{"left":0.14428191,"top":0.27653632,"width":0.03756649,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CVE-2026-24765.","depth":24,"bounds":{"left":0.08959442,"top":0.27653632,"width":0.099734046,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Your Installed Version:","depth":26,"bounds":{"left":0.1022274,"top":0.32681563,"width":0.057347074,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.55","depth":27,"bounds":{"left":0.16289894,"top":0.32801276,"width":0.019614361,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Secure Patched Version:","depth":26,"bounds":{"left":0.1022274,"top":0.35634476,"width":0.062832445,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.50","depth":27,"bounds":{"left":0.16855054,"top":0.3575419,"width":0.019448139,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(for the 11.x release branch)","depth":26,"bounds":{"left":0.1022274,"top":0.35634476,"width":0.09923537,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because you are running","depth":24,"bounds":{"left":0.08959442,"top":0.41061452,"width":0.061170213,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.55","depth":25,"bounds":{"left":0.15275931,"top":0.41181165,"width":0.019614361,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is newer than the required security patch, the unsafe deserialization flaw in the","depth":24,"bounds":{"left":0.08959442,"top":0.41061452,"width":0.108211435,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":25,"bounds":{"left":0.09158909,"top":0.47406226,"width":0.055851065,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.","depth":24,"bounds":{"left":0.08959442,"top":0.47286513,"width":0.11037234,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A quick reminder on best practices:","depth":24,"bounds":{"left":0.08959442,"top":0.5718276,"width":0.09225399,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Since you are running this inside a Docker container (","depth":24,"bounds":{"left":0.08959442,"top":0.5925778,"width":0.1022274,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker_lamp_1","depth":25,"bounds":{"left":0.11768617,"top":0.61452514,"width":0.036402926,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), just ensure that when you build your production container images, you continue to use the","depth":24,"bounds":{"left":0.08959442,"top":0.61332804,"width":0.1100399,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"--no-dev","depth":25,"bounds":{"left":0.1697141,"top":0.6560255,"width":0.022273935,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.","depth":24,"bounds":{"left":0.08959442,"top":0.6548284,"width":0.11502659,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":21,"bounds":{"left":0.086269945,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":21,"bounds":{"left":0.09690824,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
1854596301295812027
|
-3521817173830844542
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit
name : phpunit/phpunit
descrip. : The PHP Unit Testing framework.
keywords : phpunit, testing, xunit
versions : * 11.5.55
type : library
license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText
homepage : https://phpunit.de/
source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00
dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00
path : /home/jiminny/vendor/phpunit/phpunit
names : phpunit/phpunit
support
issues : https://github.com/sebastianbergmann/phpunit/issues
security : https://github.com/sebastianbergmann/phpunit/security/policy
source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55
autoload
files
classmap
src/
requires
ext-dom *
ext-json *
ext-libxml *
ext-mbstring *
ext-xml *
ext-xmlwriter *
myclabs/deep-copy ^1.13.4
phar-io/manifest ^2.0.4
phar-io/version ^3.2.1
php >=8.2
phpunit/php-code-coverage ^11.0.12
phpunit/php-file-iterator ^5.1.1
phpunit/php-invoker ^5.0.1
phpunit/php-text-template ^4.0.1
phpunit/php-timer ^7.0.1
sebastian/cli-parser ^3.0.2
sebastian/code-unit ^3.0.3
sebastian/comparator ^6.3.3
sebastian/diff ^6.0.2
sebastian/environment ^7.2.1
sebastian/exporter ^6.3.2
sebastian/global-state ^7.0.2
sebastian/object-enumerator ^6.0.1
sebastian/recursion-context ^6.0.3
sebastian/type ^5.1.3
sebastian/version ^5.0.2
staabm/side-effects-detector ^1.0.5
suggests
ext-soap To be able to generate mocks based on WSDL files
Expand
Listen
Show thinking
Gemini said
Gemini said
Assessment: Safe
Assessment: Safe
Based on the terminal output you provided, your Laravel project is
not vulnerable
to CVE-2026-24765.
Your Installed Version:
11.5.55
Secure Patched Version:
11.5.50
(for the 11.x release branch)
Because you are running
11.5.55
, which is newer than the required security patch, the unsafe deserialization flaw in the
cleanupForCoverage()
method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.
A quick reminder on best practices:
Since you are running this inside a Docker container (
docker_lamp_1
), just ensure that when you build your production container images, you continue to use the
--no-dev
flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.
Good response
Bad response...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32946
|
1259
|
14
|
2026-05-13T09:52:04.822738+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665924822_m2.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
jiminny.atlassian.net/browse/JY-19957?search_id=d4 jiminny.atlassian.net/browse/JY-19957?search_id=d436a87d-f5b4-44e0-9541-4471b4b44c1c...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit
name : phpunit/phpunit
descrip. : The PHP Unit Testing framework.
keywords : phpunit, testing, xunit
versions : * 11.5.55
type : library
license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText
homepage : https://phpunit.de/
source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00
dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00
path : /home/jiminny/vendor/phpunit/phpunit
names : phpunit/phpunit
support
issues : https://github.com/sebastianbergmann/phpunit/issues
security : https://github.com/sebastianbergmann/phpunit/security/policy
source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55
autoload
files
classmap
src/
requires
ext-dom *
ext-json *
ext-libxml *
ext-mbstring *
ext-xml *
ext-xmlwriter *
myclabs/deep-copy ^1.13.4
phar-io/manifest ^2.0.4
phar-io/version ^3.2.1
php >=8.2
phpunit/php-code-coverage ^11.0.12
phpunit/php-file-iterator ^5.1.1
phpunit/php-invoker ^5.0.1
phpunit/php-text-template ^4.0.1
phpunit/php-timer ^7.0.1
sebastian/cli-parser ^3.0.2
sebastian/code-unit ^3.0.3
sebastian/comparator ^6.3.3
sebastian/diff ^6.0.2
sebastian/environment ^7.2.1
sebastian/exporter ^6.3.2
sebastian/global-state ^7.0.2
sebastian/object-enumerator ^6.0.1
sebastian/recursion-context ^6.0.3
sebastian/type ^5.1.3
sebastian/version ^5.0.2
staabm/side-effects-detector ^1.0.5
suggests
ext-soap To be able to generate mocks based on WSDL files
Expand
Listen
Show thinking
Gemini said
Gemini said
Assessment: Safe
Assessment: Safe
Based on the terminal output you provided, your Laravel project is
not vulnerable
to CVE-2026-24765.
Your Installed Version:
11.5.55
Secure Patched Version:
11.5.50
(for the 11.x release branch)
Because you are running
11.5.55
, which is newer than the required security patch, the unsafe deserialization flaw in the
cleanupForCoverage()
method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.
A quick reminder on best practices:
Since you are running this inside a Docker container (
docker_lamp_1
), just ensure that when you build your production container images, you continue to use the
--no-dev
flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to:
Sidebar
Sidebar
Top Bar
Top Bar
Main Content
Main Content
Collapse sidebar [
Collapse sidebar [
Switch sites or apps
Switch sites or apps...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.5171588,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"7.8 (High)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requirement:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Resolution and Mitigation","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Resolution and Mitigation","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Official Patch:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The maintainer updated PHPUnit to treat pre-existing","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files as an error condition rather than attempting to sanitize and process them.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Recommended Actions:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"* Update PHPUnit to the latest patched version in your respective release branch.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Enforce code reviews and branch protection to prevent malicious file injection.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I fix these vulnareabilities in laravel project","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I fix these vulnareabilities in laravel project","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly how to secure your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check Your Current Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check Your Current Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer show phpunit/phpunit","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Look at the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"line in the output to see if you are running a vulnerable version (anything lower than 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Update PHPUnit","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Update PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tell Composer to update PHPUnit and its associated dependencies to the latest secure versions allowed by your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"constraints:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer update phpunit/phpunit --with-dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Note: If your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"restricts PHPUnit to an older major version (like","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"^9.0","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), Composer will automatically grab the secure patch for that specific major version (e.g., 9.6.33).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Verify the Fix","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Verify the Fix","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer show","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"command from step one again to confirm the version has been bumped. As long as your version is at or above one of the secure releases listed above, you are protected against CVE-2026-24765.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Secure Your Environments","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Secure Your Environments","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because PHPUnit lives in the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"require-dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"block of your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", this vulnerability does not impact your production environment—","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"provided you are deploying correctly","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Always build your production environment using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer install --no-dev --optimize-autoloader","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". This ensures testing frameworks are completely excluded from your live servers.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"For your CI/CD pipelines, ensure you are using ephemeral runners (runners that spin up fresh for every job and are destroyed afterward) so that an attacker cannot leave a malicious","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file behind for a subsequent test run to execute.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Would you like me to walk you through how to verify that your production server is completely free of development dependencies?","depth":24,"bounds":{"left":0.08959442,"top":0.0,"width":0.11502659,"height":0.057861134},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.086269945,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.09690824,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.107546546,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.11818484,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.12882313,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.1022274,"top":0.045889866,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.116855055,"top":0.045889866,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said root@docker_lamp_1:/home/jiminny# composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText homepage : https://phpunit.de/ source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00 dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00 path : /home/jiminny/vendor/phpunit/phpunit names : phpunit/phpunit support issues : https://github.com/sebastianbergmann/phpunit/issues security : https://github.com/sebastianbergmann/phpunit/security/policy source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55 autoload files classmap src/ requires ext-dom * ext-json * ext-libxml * ext-mbstring * ext-xml * ext-xmlwriter * myclabs/deep-copy ^1.13.4 phar-io/manifest ^2.0.4 phar-io/version ^3.2.1 php >=8.2 phpunit/php-code-coverage ^11.0.12 phpunit/php-file-iterator ^5.1.1 phpunit/php-invoker ^5.0.1 phpunit/php-text-template ^4.0.1 phpunit/php-timer ^7.0.1 sebastian/cli-parser ^3.0.2 sebastian/code-unit ^3.0.3 sebastian/comparator ^6.3.3 sebastian/diff ^6.0.2 sebastian/environment ^7.2.1 sebastian/exporter ^6.3.2 sebastian/global-state ^7.0.2 sebastian/object-enumerator ^6.0.1 sebastian/recursion-context ^6.0.3 sebastian/type ^5.1.3 sebastian/version ^5.0.2 staabm/side-effects-detector ^1.0.5 suggests ext-soap To be able to generate mocks based on WSDL files","depth":21,"bounds":{"left":0.13680187,"top":0.05546688,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.079288565,"top":0.056264963,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"root@docker_lamp_1:/home/jiminny# composer show phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.057063047,"width":0.051363032,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"name : phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.13367917,"width":0.04305186,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"descrip. : The PHP Unit Testing framework.","depth":23,"bounds":{"left":0.13680187,"top":0.1528332,"width":0.044049203,"height":0.054668795},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"keywords : phpunit, testing, xunit","depth":23,"bounds":{"left":0.13680187,"top":0.21029529,"width":0.046875,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions : * 11.5.55","depth":23,"bounds":{"left":0.13680187,"top":0.24860336,"width":0.04338431,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"type : library","depth":23,"bounds":{"left":0.13680187,"top":0.2677574,"width":0.035738032,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"license : BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText","depth":23,"bounds":{"left":0.13680187,"top":0.2869114,"width":0.051529255,"height":0.16959298},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"homepage : https://phpunit.de/","depth":23,"bounds":{"left":0.13680187,"top":0.4592977,"width":0.046875,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00","depth":23,"bounds":{"left":0.13680187,"top":0.49760574,"width":0.051529255,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00","depth":23,"bounds":{"left":0.13680187,"top":0.63168395,"width":0.051030584,"height":0.20790103},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"path : /home/jiminny/vendor/phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.8423783,"width":0.03856383,"height":0.054668795},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"names : phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.89984035,"width":0.044215426,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"support","depth":23,"bounds":{"left":0.13680187,"top":0.95730245,"width":0.018949468,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"issues : https://github.com/sebastianbergmann/phpunit/issues","depth":23,"bounds":{"left":0.13680187,"top":0.9764565,"width":0.049534574,"height":0.023543477},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"security : https://github.com/sebastianbergmann/phpunit/security/policy","depth":23,"bounds":{"left":0.13680187,"top":1.0,"width":0.049534574,"height":-0.05307257},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"autoload","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"classmap","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"src/","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"requires","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-dom *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-json *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-libxml *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-mbstring *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-xml *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-xmlwriter *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"myclabs/deep-copy ^1.13.4","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phar-io/manifest ^2.0.4","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phar-io/version ^3.2.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php >=8.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-code-coverage ^11.0.12","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-file-iterator ^5.1.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-invoker ^5.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-text-template ^4.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-timer ^7.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/cli-parser ^3.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/code-unit ^3.0.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/comparator ^6.3.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/diff ^6.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/environment ^7.2.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/exporter ^6.3.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/global-state ^7.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/object-enumerator ^6.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/recursion-context ^6.0.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/type ^5.1.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/version ^5.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"staabm/side-effects-detector ^1.0.5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"suggests","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-soap To be able to generate mocks based on WSDL files","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.18866356,"top":0.05546688,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.1939827,"top":0.18316041,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.10289229,"top":0.18555467,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.10056516,"top":0.22705507,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.10056516,"top":0.22905028,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Assessment: Safe","depth":23,"bounds":{"left":0.08959442,"top":0.22785315,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Assessment: Safe","depth":24,"bounds":{"left":0.08959442,"top":0.22944932,"width":0.045711435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Based on the terminal output you provided, your Laravel project is","depth":24,"bounds":{"left":0.08959442,"top":0.25578612,"width":0.105884306,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not vulnerable","depth":24,"bounds":{"left":0.14428191,"top":0.27653632,"width":0.03756649,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CVE-2026-24765.","depth":24,"bounds":{"left":0.08959442,"top":0.27653632,"width":0.099734046,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Your Installed Version:","depth":26,"bounds":{"left":0.1022274,"top":0.32681563,"width":0.057347074,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.55","depth":27,"bounds":{"left":0.16289894,"top":0.32801276,"width":0.019614361,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Secure Patched Version:","depth":26,"bounds":{"left":0.1022274,"top":0.35634476,"width":0.062832445,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.50","depth":27,"bounds":{"left":0.16855054,"top":0.3575419,"width":0.019448139,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(for the 11.x release branch)","depth":26,"bounds":{"left":0.1022274,"top":0.35634476,"width":0.09923537,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because you are running","depth":24,"bounds":{"left":0.08959442,"top":0.41061452,"width":0.061170213,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.55","depth":25,"bounds":{"left":0.15275931,"top":0.41181165,"width":0.019614361,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is newer than the required security patch, the unsafe deserialization flaw in the","depth":24,"bounds":{"left":0.08959442,"top":0.41061452,"width":0.108211435,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":25,"bounds":{"left":0.09158909,"top":0.47406226,"width":0.055851065,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.","depth":24,"bounds":{"left":0.08959442,"top":0.47286513,"width":0.11037234,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A quick reminder on best practices:","depth":24,"bounds":{"left":0.08959442,"top":0.5718276,"width":0.09225399,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Since you are running this inside a Docker container (","depth":24,"bounds":{"left":0.08959442,"top":0.5925778,"width":0.1022274,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker_lamp_1","depth":25,"bounds":{"left":0.11768617,"top":0.61452514,"width":0.036402926,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), just ensure that when you build your production container images, you continue to use the","depth":24,"bounds":{"left":0.08959442,"top":0.61332804,"width":0.1100399,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"--no-dev","depth":25,"bounds":{"left":0.1697141,"top":0.6560255,"width":0.022273935,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.","depth":24,"bounds":{"left":0.08959442,"top":0.6548284,"width":0.11502659,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":21,"bounds":{"left":0.086269945,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":21,"bounds":{"left":0.09690824,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Redo","depth":21,"bounds":{"left":0.107546546,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Share & export","depth":20,"bounds":{"left":0.11818484,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":21,"bounds":{"left":0.12882313,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":20,"bounds":{"left":0.13946144,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXTextArea","text":"Enter a prompt for Gemini\nencrypted","depth":20,"bounds":{"left":0.09291888,"top":0.8216281,"width":0.10638298,"height":0.01915403},"on_screen":true,"value":"Enter a prompt for Gemini\nencrypted","help_text":"","role_description":"text entry area","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Enter a prompt for Gemini","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"encrypted","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open upload file menu","depth":20,"bounds":{"left":0.08892952,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Tools","depth":18,"bounds":{"left":0.10488697,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Open mode picker","depth":20,"bounds":{"left":0.1619016,"top":0.85514766,"width":0.026097074,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Pro","depth":23,"bounds":{"left":0.16722074,"top":0.8639266,"width":0.007480053,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Microphone","depth":19,"bounds":{"left":0.18999335,"top":0.85514766,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Send message","depth":19,"bounds":{"left":0.19630983,"top":0.85434955,"width":0.013962766,"height":0.033519555},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":false,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.","depth":17,"bounds":{"left":0.08510638,"top":0.90901834,"width":0.11951463,"height":0.025139665},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Your privacy & Gemini Opens in a new window","depth":17,"bounds":{"left":0.16705452,"top":0.92178774,"width":0.040059842,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Your privacy & Gemini","depth":18,"bounds":{"left":0.16705452,"top":0.92178774,"width":0.040059842,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Opens in a new window","depth":19,"bounds":{"left":0.079288565,"top":0.92098963,"width":0.043218084,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Summarize page","depth":7,"bounds":{"left":0.08494016,"top":0.95730245,"width":0.053523935,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Summarize page","depth":9,"bounds":{"left":0.09059176,"top":0.96249,"width":0.042220745,"height":0.015163607},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Skip to:","depth":9,"bounds":{"left":0.22606383,"top":0.07861133,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Sidebar","depth":10,"bounds":{"left":0.22606383,"top":0.097765364,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Sidebar","depth":11,"bounds":{"left":0.22606383,"top":0.097765364,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Top Bar","depth":10,"bounds":{"left":0.22606383,"top":0.11691939,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Top Bar","depth":11,"bounds":{"left":0.22606383,"top":0.11691939,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Main Content","depth":10,"bounds":{"left":0.22606383,"top":0.13607343,"width":0.029421542,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Main Content","depth":11,"bounds":{"left":0.22606383,"top":0.13607343,"width":0.029421542,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Collapse sidebar [","depth":9,"bounds":{"left":0.21941489,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Collapse sidebar [","depth":11,"bounds":{"left":0.22456782,"top":0.06344773,"width":0.039727394,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Switch sites or apps","depth":10,"bounds":{"left":0.23138298,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Switch sites or apps","depth":12,"bounds":{"left":0.2365359,"top":0.06344773,"width":0.044215426,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
878211594284507853
|
-3810047618701770878
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit
name : phpunit/phpunit
descrip. : The PHP Unit Testing framework.
keywords : phpunit, testing, xunit
versions : * 11.5.55
type : library
license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText
homepage : https://phpunit.de/
source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00
dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00
path : /home/jiminny/vendor/phpunit/phpunit
names : phpunit/phpunit
support
issues : https://github.com/sebastianbergmann/phpunit/issues
security : https://github.com/sebastianbergmann/phpunit/security/policy
source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55
autoload
files
classmap
src/
requires
ext-dom *
ext-json *
ext-libxml *
ext-mbstring *
ext-xml *
ext-xmlwriter *
myclabs/deep-copy ^1.13.4
phar-io/manifest ^2.0.4
phar-io/version ^3.2.1
php >=8.2
phpunit/php-code-coverage ^11.0.12
phpunit/php-file-iterator ^5.1.1
phpunit/php-invoker ^5.0.1
phpunit/php-text-template ^4.0.1
phpunit/php-timer ^7.0.1
sebastian/cli-parser ^3.0.2
sebastian/code-unit ^3.0.3
sebastian/comparator ^6.3.3
sebastian/diff ^6.0.2
sebastian/environment ^7.2.1
sebastian/exporter ^6.3.2
sebastian/global-state ^7.0.2
sebastian/object-enumerator ^6.0.1
sebastian/recursion-context ^6.0.3
sebastian/type ^5.1.3
sebastian/version ^5.0.2
staabm/side-effects-detector ^1.0.5
suggests
ext-soap To be able to generate mocks based on WSDL files
Expand
Listen
Show thinking
Gemini said
Gemini said
Assessment: Safe
Assessment: Safe
Based on the terminal output you provided, your Laravel project is
not vulnerable
to CVE-2026-24765.
Your Installed Version:
11.5.55
Secure Patched Version:
11.5.50
(for the 11.x release branch)
Because you are running
11.5.55
, which is newer than the required security patch, the unsafe deserialization flaw in the
cleanupForCoverage()
method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.
A quick reminder on best practices:
Since you are running this inside a Docker container (
docker_lamp_1
), just ensure that when you build your production container images, you continue to use the
--no-dev
flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to:
Sidebar
Sidebar
Top Bar
Top Bar
Main Content
Main Content
Collapse sidebar [
Collapse sidebar [
Switch sites or apps
Switch sites or apps...
|
32945
|
NULL
|
NULL
|
NULL
|
|
32947
|
1259
|
15
|
2026-05-13T09:52:13.874715+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665933874_m2.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
jiminny.atlassian.net/browse/JY-19957?search_id=d4 jiminny.atlassian.net/browse/JY-19957?search_id=d436a87d-f5b4-44e0-9541-4471b4b44c1c...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit
name : phpunit/phpunit
descrip. : The PHP Unit Testing framework.
keywords : phpunit, testing, xunit
versions : * 11.5.55
type : library
license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText
homepage : https://phpunit.de/
source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00
dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00
path : /home/jiminny/vendor/phpunit/phpunit
names : phpunit/phpunit
support
issues : https://github.com/sebastianbergmann/phpunit/issues
security : https://github.com/sebastianbergmann/phpunit/security/policy
source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55
autoload
files
classmap
src/
requires
ext-dom *
ext-json *
ext-libxml *
ext-mbstring *
ext-xml *
ext-xmlwriter *
myclabs/deep-copy ^1.13.4
phar-io/manifest ^2.0.4
phar-io/version ^3.2.1
php >=8.2
phpunit/php-code-coverage ^11.0.12
phpunit/php-file-iterator ^5.1.1
phpunit/php-invoker ^5.0.1
phpunit/php-text-template ^4.0.1
phpunit/php-timer ^7.0.1
sebastian/cli-parser ^3.0.2
sebastian/code-unit ^3.0.3
sebastian/comparator ^6.3.3
sebastian/diff ^6.0.2
sebastian/environment ^7.2.1
sebastian/exporter ^6.3.2
sebastian/global-state ^7.0.2
sebastian/object-enumerator ^6.0.1
sebastian/recursion-context ^6.0.3
sebastian/type ^5.1.3
sebastian/version ^5.0.2
staabm/side-effects-detector ^1.0.5
suggests
ext-soap To be able to generate mocks based on WSDL files
Expand
Listen
Show thinking
Gemini said
Gemini said
Assessment: Safe
Assessment: Safe
Based on the terminal output you provided, your Laravel project is
not vulnerable
to CVE-2026-24765.
Your Installed Version:
11.5.55
Secure Patched Version:
11.5.50
(for the 11.x release branch)
Because you are running
11.5.55
, which is newer than the required security patch, the unsafe deserialization flaw in the
cleanupForCoverage()
method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.
A quick reminder on best practices:
Since you are running this inside a Docker container (
docker_lamp_1
), just ensure that when you build your production container images, you continue to use the
--no-dev
flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.
Good response...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.5171588,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"7.8 (High)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requirement:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Resolution and Mitigation","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Resolution and Mitigation","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Official Patch:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The maintainer updated PHPUnit to treat pre-existing","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files as an error condition rather than attempting to sanitize and process them.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Recommended Actions:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"* Update PHPUnit to the latest patched version in your respective release branch.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Enforce code reviews and branch protection to prevent malicious file injection.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I fix these vulnareabilities in laravel project","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I fix these vulnareabilities in laravel project","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly how to secure your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check Your Current Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check Your Current Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer show phpunit/phpunit","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Look at the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"line in the output to see if you are running a vulnerable version (anything lower than 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Update PHPUnit","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Update PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tell Composer to update PHPUnit and its associated dependencies to the latest secure versions allowed by your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"constraints:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer update phpunit/phpunit --with-dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Note: If your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"restricts PHPUnit to an older major version (like","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"^9.0","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), Composer will automatically grab the secure patch for that specific major version (e.g., 9.6.33).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Verify the Fix","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Verify the Fix","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer show","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"command from step one again to confirm the version has been bumped. As long as your version is at or above one of the secure releases listed above, you are protected against CVE-2026-24765.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Secure Your Environments","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Secure Your Environments","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because PHPUnit lives in the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"require-dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"block of your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", this vulnerability does not impact your production environment—","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"provided you are deploying correctly","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Always build your production environment using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer install --no-dev --optimize-autoloader","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". This ensures testing frameworks are completely excluded from your live servers.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"For your CI/CD pipelines, ensure you are using ephemeral runners (runners that spin up fresh for every job and are destroyed afterward) so that an attacker cannot leave a malicious","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file behind for a subsequent test run to execute.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Would you like me to walk you through how to verify that your production server is completely free of development dependencies?","depth":24,"bounds":{"left":0.08959442,"top":0.0,"width":0.11502659,"height":0.057861134},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.086269945,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.09690824,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.107546546,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.11818484,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.12882313,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.1022274,"top":0.045889866,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.116855055,"top":0.045889866,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said root@docker_lamp_1:/home/jiminny# composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText homepage : https://phpunit.de/ source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00 dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00 path : /home/jiminny/vendor/phpunit/phpunit names : phpunit/phpunit support issues : https://github.com/sebastianbergmann/phpunit/issues security : https://github.com/sebastianbergmann/phpunit/security/policy source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55 autoload files classmap src/ requires ext-dom * ext-json * ext-libxml * ext-mbstring * ext-xml * ext-xmlwriter * myclabs/deep-copy ^1.13.4 phar-io/manifest ^2.0.4 phar-io/version ^3.2.1 php >=8.2 phpunit/php-code-coverage ^11.0.12 phpunit/php-file-iterator ^5.1.1 phpunit/php-invoker ^5.0.1 phpunit/php-text-template ^4.0.1 phpunit/php-timer ^7.0.1 sebastian/cli-parser ^3.0.2 sebastian/code-unit ^3.0.3 sebastian/comparator ^6.3.3 sebastian/diff ^6.0.2 sebastian/environment ^7.2.1 sebastian/exporter ^6.3.2 sebastian/global-state ^7.0.2 sebastian/object-enumerator ^6.0.1 sebastian/recursion-context ^6.0.3 sebastian/type ^5.1.3 sebastian/version ^5.0.2 staabm/side-effects-detector ^1.0.5 suggests ext-soap To be able to generate mocks based on WSDL files","depth":21,"bounds":{"left":0.13680187,"top":0.05546688,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.079288565,"top":0.056264963,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"root@docker_lamp_1:/home/jiminny# composer show phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.057063047,"width":0.051363032,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"name : phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.13367917,"width":0.04305186,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"descrip. : The PHP Unit Testing framework.","depth":23,"bounds":{"left":0.13680187,"top":0.1528332,"width":0.044049203,"height":0.054668795},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"keywords : phpunit, testing, xunit","depth":23,"bounds":{"left":0.13680187,"top":0.21029529,"width":0.046875,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions : * 11.5.55","depth":23,"bounds":{"left":0.13680187,"top":0.24860336,"width":0.04338431,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"type : library","depth":23,"bounds":{"left":0.13680187,"top":0.2677574,"width":0.035738032,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"license : BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText","depth":23,"bounds":{"left":0.13680187,"top":0.2869114,"width":0.051529255,"height":0.16959298},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"homepage : https://phpunit.de/","depth":23,"bounds":{"left":0.13680187,"top":0.4592977,"width":0.046875,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00","depth":23,"bounds":{"left":0.13680187,"top":0.49760574,"width":0.051529255,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00","depth":23,"bounds":{"left":0.13680187,"top":0.63168395,"width":0.051030584,"height":0.20790103},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"path : /home/jiminny/vendor/phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.8423783,"width":0.03856383,"height":0.054668795},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"names : phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.89984035,"width":0.044215426,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"support","depth":23,"bounds":{"left":0.13680187,"top":0.95730245,"width":0.018949468,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"issues : https://github.com/sebastianbergmann/phpunit/issues","depth":23,"bounds":{"left":0.13680187,"top":0.9764565,"width":0.049534574,"height":0.023543477},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"security : https://github.com/sebastianbergmann/phpunit/security/policy","depth":23,"bounds":{"left":0.13680187,"top":1.0,"width":0.049534574,"height":-0.05307257},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"autoload","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"classmap","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"src/","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"requires","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-dom *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-json *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-libxml *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-mbstring *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-xml *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-xmlwriter *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"myclabs/deep-copy ^1.13.4","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phar-io/manifest ^2.0.4","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phar-io/version ^3.2.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php >=8.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-code-coverage ^11.0.12","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-file-iterator ^5.1.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-invoker ^5.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-text-template ^4.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-timer ^7.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/cli-parser ^3.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/code-unit ^3.0.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/comparator ^6.3.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/diff ^6.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/environment ^7.2.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/exporter ^6.3.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/global-state ^7.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/object-enumerator ^6.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/recursion-context ^6.0.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/type ^5.1.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/version ^5.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"staabm/side-effects-detector ^1.0.5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"suggests","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-soap To be able to generate mocks based on WSDL files","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.18866356,"top":0.05546688,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.1939827,"top":0.18316041,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.10289229,"top":0.18555467,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.10056516,"top":0.22705507,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.10056516,"top":0.22905028,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Assessment: Safe","depth":23,"bounds":{"left":0.08959442,"top":0.22785315,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Assessment: Safe","depth":24,"bounds":{"left":0.08959442,"top":0.22944932,"width":0.045711435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Based on the terminal output you provided, your Laravel project is","depth":24,"bounds":{"left":0.08959442,"top":0.25578612,"width":0.105884306,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not vulnerable","depth":24,"bounds":{"left":0.14428191,"top":0.27653632,"width":0.03756649,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CVE-2026-24765.","depth":24,"bounds":{"left":0.08959442,"top":0.27653632,"width":0.099734046,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Your Installed Version:","depth":26,"bounds":{"left":0.1022274,"top":0.32681563,"width":0.057347074,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.55","depth":27,"bounds":{"left":0.16289894,"top":0.32801276,"width":0.019614361,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Secure Patched Version:","depth":26,"bounds":{"left":0.1022274,"top":0.35634476,"width":0.062832445,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.50","depth":27,"bounds":{"left":0.16855054,"top":0.3575419,"width":0.019448139,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(for the 11.x release branch)","depth":26,"bounds":{"left":0.1022274,"top":0.35634476,"width":0.09923537,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because you are running","depth":24,"bounds":{"left":0.08959442,"top":0.41061452,"width":0.061170213,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.55","depth":25,"bounds":{"left":0.15275931,"top":0.41181165,"width":0.019614361,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is newer than the required security patch, the unsafe deserialization flaw in the","depth":24,"bounds":{"left":0.08959442,"top":0.41061452,"width":0.108211435,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":25,"bounds":{"left":0.09158909,"top":0.47406226,"width":0.055851065,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.","depth":24,"bounds":{"left":0.08959442,"top":0.47286513,"width":0.11037234,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A quick reminder on best practices:","depth":24,"bounds":{"left":0.08959442,"top":0.5718276,"width":0.09225399,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Since you are running this inside a Docker container (","depth":24,"bounds":{"left":0.08959442,"top":0.5925778,"width":0.1022274,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker_lamp_1","depth":25,"bounds":{"left":0.11768617,"top":0.61452514,"width":0.036402926,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), just ensure that when you build your production container images, you continue to use the","depth":24,"bounds":{"left":0.08959442,"top":0.61332804,"width":0.1100399,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"--no-dev","depth":25,"bounds":{"left":0.1697141,"top":0.6560255,"width":0.022273935,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.","depth":24,"bounds":{"left":0.08959442,"top":0.6548284,"width":0.11502659,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":21,"bounds":{"left":0.086269945,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
9183834644728356920
|
-3521817173830844542
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit
name : phpunit/phpunit
descrip. : The PHP Unit Testing framework.
keywords : phpunit, testing, xunit
versions : * 11.5.55
type : library
license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText
homepage : https://phpunit.de/
source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00
dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00
path : /home/jiminny/vendor/phpunit/phpunit
names : phpunit/phpunit
support
issues : https://github.com/sebastianbergmann/phpunit/issues
security : https://github.com/sebastianbergmann/phpunit/security/policy
source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55
autoload
files
classmap
src/
requires
ext-dom *
ext-json *
ext-libxml *
ext-mbstring *
ext-xml *
ext-xmlwriter *
myclabs/deep-copy ^1.13.4
phar-io/manifest ^2.0.4
phar-io/version ^3.2.1
php >=8.2
phpunit/php-code-coverage ^11.0.12
phpunit/php-file-iterator ^5.1.1
phpunit/php-invoker ^5.0.1
phpunit/php-text-template ^4.0.1
phpunit/php-timer ^7.0.1
sebastian/cli-parser ^3.0.2
sebastian/code-unit ^3.0.3
sebastian/comparator ^6.3.3
sebastian/diff ^6.0.2
sebastian/environment ^7.2.1
sebastian/exporter ^6.3.2
sebastian/global-state ^7.0.2
sebastian/object-enumerator ^6.0.1
sebastian/recursion-context ^6.0.3
sebastian/type ^5.1.3
sebastian/version ^5.0.2
staabm/side-effects-detector ^1.0.5
suggests
ext-soap To be able to generate mocks based on WSDL files
Expand
Listen
Show thinking
Gemini said
Gemini said
Assessment: Safe
Assessment: Safe
Based on the terminal output you provided, your Laravel project is
not vulnerable
to CVE-2026-24765.
Your Installed Version:
11.5.55
Secure Patched Version:
11.5.50
(for the 11.x release branch)
Because you are running
11.5.55
, which is newer than the required security patch, the unsafe deserialization flaw in the
cleanupForCoverage()
method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.
A quick reminder on best practices:
Since you are running this inside a Docker container (
docker_lamp_1
), just ensure that when you build your production container images, you continue to use the
--no-dev
flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.
Good response...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32948
|
1258
|
11
|
2026-05-13T09:52:17.452235+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665937452_m1.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
jiminny.atlassian.net/browse/JY-19957?search_id=d4 jiminny.atlassian.net/browse/JY-19957?search_id=d436a87d-f5b4-44e0-9541-4471b4b44c1c...
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
5344430767449231167
|
-130958617327879034
|
click
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32949
|
1259
|
16
|
2026-05-13T09:52:17.460542+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665937460_m2.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
jiminny.atlassian.net/browse/JY-19957?search_id=d4 jiminny.atlassian.net/browse/JY-19957?search_id=d436a87d-f5b4-44e0-9541-4471b4b44c1c...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.5171588,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-5331796612740349942
|
-419188993479590778
|
click
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web...
|
32947
|
NULL
|
NULL
|
NULL
|
|
32957
|
1259
|
22
|
2026-05-13T09:52:32.002505+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778665952002_m2.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
jiminny.atlassian.net/browse/JY-19957?search_id=d4 jiminny.atlassian.net/browse/JY-19957?search_id=d436a87d-f5b4-44e0-9541-4471b4b44c1c...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit
name : phpunit/phpunit
descrip. : The PHP Unit Testing framework.
keywords : phpunit, testing, xunit
versions : * 11.5.55
type : library
license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText
homepage : https://phpunit.de/
source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00
dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00
path : /home/jiminny/vendor/phpunit/phpunit
names : phpunit/phpunit
support
issues : https://github.com/sebastianbergmann/phpunit/issues
security : https://github.com/sebastianbergmann/phpunit/security/policy
source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55
autoload
files
classmap
src/
requires
ext-dom *
ext-json *
ext-libxml *
ext-mbstring *
ext-xml *
ext-xmlwriter *
myclabs/deep-copy ^1.13.4
phar-io/manifest ^2.0.4
phar-io/version ^3.2.1
php >=8.2
phpunit/php-code-coverage ^11.0.12
phpunit/php-file-iterator ^5.1.1
phpunit/php-invoker ^5.0.1
phpunit/php-text-template ^4.0.1
phpunit/php-timer ^7.0.1
sebastian/cli-parser ^3.0.2
sebastian/code-unit ^3.0.3
sebastian/comparator ^6.3.3
sebastian/diff ^6.0.2
sebastian/environment ^7.2.1
sebastian/exporter ^6.3.2
sebastian/global-state ^7.0.2
sebastian/object-enumerator ^6.0.1
sebastian/recursion-context ^6.0.3
sebastian/type ^5.1.3
sebastian/version ^5.0.2
staabm/side-effects-detector ^1.0.5
suggests
ext-soap To be able to generate mocks based on WSDL files
Expand
Listen
Show thinking
Gemini said
Gemini said
Assessment: Safe
Assessment: Safe
Based on the terminal output you provided, your Laravel project is
not vulnerable
to CVE-2026-24765.
Your Installed Version:
11.5.55
Secure Patched Version:
11.5.50
(for the 11.x release branch)
Because you are running
11.5.55
, which is newer than the required security patch, the unsafe deserialization flaw in the
cleanupForCoverage()
method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.
A quick reminder on best practices:
Since you are running this inside a Docker container (
docker_lamp_1
), just ensure that when you build your production container images, you continue to use the
--no-dev
flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to:
Sidebar
Sidebar...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.5171588,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"7.8 (High)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requirement:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Resolution and Mitigation","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Resolution and Mitigation","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Official Patch:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The maintainer updated PHPUnit to treat pre-existing","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files as an error condition rather than attempting to sanitize and process them.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Recommended Actions:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"* Update PHPUnit to the latest patched version in your respective release branch.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Enforce code reviews and branch protection to prevent malicious file injection.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I fix these vulnareabilities in laravel project","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I fix these vulnareabilities in laravel project","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly how to secure your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check Your Current Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check Your Current Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer show phpunit/phpunit","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Look at the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"line in the output to see if you are running a vulnerable version (anything lower than 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Update PHPUnit","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Update PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tell Composer to update PHPUnit and its associated dependencies to the latest secure versions allowed by your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"constraints:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer update phpunit/phpunit --with-dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Note: If your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"restricts PHPUnit to an older major version (like","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"^9.0","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), Composer will automatically grab the secure patch for that specific major version (e.g., 9.6.33).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Verify the Fix","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Verify the Fix","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer show","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"command from step one again to confirm the version has been bumped. As long as your version is at or above one of the secure releases listed above, you are protected against CVE-2026-24765.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Secure Your Environments","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Secure Your Environments","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because PHPUnit lives in the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"require-dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"block of your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", this vulnerability does not impact your production environment—","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"provided you are deploying correctly","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Always build your production environment using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer install --no-dev --optimize-autoloader","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". This ensures testing frameworks are completely excluded from your live servers.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"For your CI/CD pipelines, ensure you are using ephemeral runners (runners that spin up fresh for every job and are destroyed afterward) so that an attacker cannot leave a malicious","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file behind for a subsequent test run to execute.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Would you like me to walk you through how to verify that your production server is completely free of development dependencies?","depth":24,"bounds":{"left":0.08959442,"top":0.0,"width":0.11502659,"height":0.057861134},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.086269945,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.09690824,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.107546546,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.11818484,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.12882313,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.1022274,"top":0.045889866,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.116855055,"top":0.045889866,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said root@docker_lamp_1:/home/jiminny# composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText homepage : https://phpunit.de/ source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00 dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00 path : /home/jiminny/vendor/phpunit/phpunit names : phpunit/phpunit support issues : https://github.com/sebastianbergmann/phpunit/issues security : https://github.com/sebastianbergmann/phpunit/security/policy source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55 autoload files classmap src/ requires ext-dom * ext-json * ext-libxml * ext-mbstring * ext-xml * ext-xmlwriter * myclabs/deep-copy ^1.13.4 phar-io/manifest ^2.0.4 phar-io/version ^3.2.1 php >=8.2 phpunit/php-code-coverage ^11.0.12 phpunit/php-file-iterator ^5.1.1 phpunit/php-invoker ^5.0.1 phpunit/php-text-template ^4.0.1 phpunit/php-timer ^7.0.1 sebastian/cli-parser ^3.0.2 sebastian/code-unit ^3.0.3 sebastian/comparator ^6.3.3 sebastian/diff ^6.0.2 sebastian/environment ^7.2.1 sebastian/exporter ^6.3.2 sebastian/global-state ^7.0.2 sebastian/object-enumerator ^6.0.1 sebastian/recursion-context ^6.0.3 sebastian/type ^5.1.3 sebastian/version ^5.0.2 staabm/side-effects-detector ^1.0.5 suggests ext-soap To be able to generate mocks based on WSDL files","depth":21,"bounds":{"left":0.13680187,"top":0.05546688,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.079288565,"top":0.056264963,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"root@docker_lamp_1:/home/jiminny# composer show phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.057063047,"width":0.051363032,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"name : phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.13367917,"width":0.04305186,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"descrip. : The PHP Unit Testing framework.","depth":23,"bounds":{"left":0.13680187,"top":0.1528332,"width":0.044049203,"height":0.054668795},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"keywords : phpunit, testing, xunit","depth":23,"bounds":{"left":0.13680187,"top":0.21029529,"width":0.046875,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions : * 11.5.55","depth":23,"bounds":{"left":0.13680187,"top":0.24860336,"width":0.04338431,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"type : library","depth":23,"bounds":{"left":0.13680187,"top":0.2677574,"width":0.035738032,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"license : BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText","depth":23,"bounds":{"left":0.13680187,"top":0.2869114,"width":0.051529255,"height":0.16959298},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"homepage : https://phpunit.de/","depth":23,"bounds":{"left":0.13680187,"top":0.4592977,"width":0.046875,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00","depth":23,"bounds":{"left":0.13680187,"top":0.49760574,"width":0.051529255,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00","depth":23,"bounds":{"left":0.13680187,"top":0.63168395,"width":0.051030584,"height":0.20790103},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"path : /home/jiminny/vendor/phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.8423783,"width":0.03856383,"height":0.054668795},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"names : phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.89984035,"width":0.044215426,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"support","depth":23,"bounds":{"left":0.13680187,"top":0.95730245,"width":0.018949468,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"issues : https://github.com/sebastianbergmann/phpunit/issues","depth":23,"bounds":{"left":0.13680187,"top":0.9764565,"width":0.049534574,"height":0.023543477},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"security : https://github.com/sebastianbergmann/phpunit/security/policy","depth":23,"bounds":{"left":0.13680187,"top":1.0,"width":0.049534574,"height":-0.05307257},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"autoload","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"classmap","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"src/","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"requires","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-dom *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-json *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-libxml *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-mbstring *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-xml *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-xmlwriter *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"myclabs/deep-copy ^1.13.4","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phar-io/manifest ^2.0.4","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phar-io/version ^3.2.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php >=8.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-code-coverage ^11.0.12","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-file-iterator ^5.1.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-invoker ^5.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-text-template ^4.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-timer ^7.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/cli-parser ^3.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/code-unit ^3.0.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/comparator ^6.3.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/diff ^6.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/environment ^7.2.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/exporter ^6.3.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/global-state ^7.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/object-enumerator ^6.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/recursion-context ^6.0.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/type ^5.1.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/version ^5.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"staabm/side-effects-detector ^1.0.5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"suggests","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-soap To be able to generate mocks based on WSDL files","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.18866356,"top":0.05546688,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.1939827,"top":0.18316041,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.10289229,"top":0.18555467,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.10056516,"top":0.22705507,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.10056516,"top":0.22905028,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Assessment: Safe","depth":23,"bounds":{"left":0.08959442,"top":0.22785315,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Assessment: Safe","depth":24,"bounds":{"left":0.08959442,"top":0.22944932,"width":0.045711435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Based on the terminal output you provided, your Laravel project is","depth":24,"bounds":{"left":0.08959442,"top":0.25578612,"width":0.105884306,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not vulnerable","depth":24,"bounds":{"left":0.14428191,"top":0.27653632,"width":0.03756649,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CVE-2026-24765.","depth":24,"bounds":{"left":0.08959442,"top":0.27653632,"width":0.099734046,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Your Installed Version:","depth":26,"bounds":{"left":0.1022274,"top":0.32681563,"width":0.057347074,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.55","depth":27,"bounds":{"left":0.16289894,"top":0.32801276,"width":0.019614361,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Secure Patched Version:","depth":26,"bounds":{"left":0.1022274,"top":0.35634476,"width":0.062832445,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.50","depth":27,"bounds":{"left":0.16855054,"top":0.3575419,"width":0.019448139,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(for the 11.x release branch)","depth":26,"bounds":{"left":0.1022274,"top":0.35634476,"width":0.09923537,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because you are running","depth":24,"bounds":{"left":0.08959442,"top":0.41061452,"width":0.061170213,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.55","depth":25,"bounds":{"left":0.15275931,"top":0.41181165,"width":0.019614361,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is newer than the required security patch, the unsafe deserialization flaw in the","depth":24,"bounds":{"left":0.08959442,"top":0.41061452,"width":0.108211435,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":25,"bounds":{"left":0.09158909,"top":0.47406226,"width":0.055851065,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.","depth":24,"bounds":{"left":0.08959442,"top":0.47286513,"width":0.11037234,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A quick reminder on best practices:","depth":24,"bounds":{"left":0.08959442,"top":0.5718276,"width":0.09225399,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Since you are running this inside a Docker container (","depth":24,"bounds":{"left":0.08959442,"top":0.5925778,"width":0.1022274,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker_lamp_1","depth":25,"bounds":{"left":0.11768617,"top":0.61452514,"width":0.036402926,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), just ensure that when you build your production container images, you continue to use the","depth":24,"bounds":{"left":0.08959442,"top":0.61332804,"width":0.1100399,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"--no-dev","depth":25,"bounds":{"left":0.1697141,"top":0.6560255,"width":0.022273935,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.","depth":24,"bounds":{"left":0.08959442,"top":0.6548284,"width":0.11502659,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":21,"bounds":{"left":0.086269945,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":21,"bounds":{"left":0.09690824,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Redo","depth":21,"bounds":{"left":0.107546546,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Share & export","depth":20,"bounds":{"left":0.11818484,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":21,"bounds":{"left":0.12882313,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":20,"bounds":{"left":0.13946144,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXTextArea","text":"Enter a prompt for Gemini\nencrypted","depth":20,"bounds":{"left":0.09291888,"top":0.8216281,"width":0.10638298,"height":0.01915403},"on_screen":true,"value":"Enter a prompt for Gemini\nencrypted","help_text":"","role_description":"text entry area","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Enter a prompt for Gemini","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"encrypted","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open upload file menu","depth":20,"bounds":{"left":0.08892952,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Tools","depth":18,"bounds":{"left":0.10488697,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Open mode picker","depth":20,"bounds":{"left":0.1619016,"top":0.85514766,"width":0.026097074,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Pro","depth":23,"bounds":{"left":0.16722074,"top":0.8639266,"width":0.007480053,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Microphone","depth":19,"bounds":{"left":0.18999335,"top":0.85514766,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Send message","depth":19,"bounds":{"left":0.19630983,"top":0.85434955,"width":0.013962766,"height":0.033519555},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":false,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.","depth":17,"bounds":{"left":0.08510638,"top":0.90901834,"width":0.11951463,"height":0.025139665},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Your privacy & Gemini Opens in a new window","depth":17,"bounds":{"left":0.16705452,"top":0.92178774,"width":0.040059842,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Your privacy & Gemini","depth":18,"bounds":{"left":0.16705452,"top":0.92178774,"width":0.040059842,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Opens in a new window","depth":19,"bounds":{"left":0.079288565,"top":0.92098963,"width":0.043218084,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Summarize page","depth":7,"bounds":{"left":0.08494016,"top":0.95730245,"width":0.053523935,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Summarize page","depth":9,"bounds":{"left":0.09059176,"top":0.96249,"width":0.042220745,"height":0.015163607},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Skip to:","depth":9,"bounds":{"left":0.22606383,"top":0.07861133,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Sidebar","depth":10,"bounds":{"left":0.22606383,"top":0.097765364,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Sidebar","depth":11,"bounds":{"left":0.22606383,"top":0.097765364,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
2285364767831442526
|
-2648118846120706174
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit
name : phpunit/phpunit
descrip. : The PHP Unit Testing framework.
keywords : phpunit, testing, xunit
versions : * 11.5.55
type : library
license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText
homepage : https://phpunit.de/
source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00
dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00
path : /home/jiminny/vendor/phpunit/phpunit
names : phpunit/phpunit
support
issues : https://github.com/sebastianbergmann/phpunit/issues
security : https://github.com/sebastianbergmann/phpunit/security/policy
source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55
autoload
files
classmap
src/
requires
ext-dom *
ext-json *
ext-libxml *
ext-mbstring *
ext-xml *
ext-xmlwriter *
myclabs/deep-copy ^1.13.4
phar-io/manifest ^2.0.4
phar-io/version ^3.2.1
php >=8.2
phpunit/php-code-coverage ^11.0.12
phpunit/php-file-iterator ^5.1.1
phpunit/php-invoker ^5.0.1
phpunit/php-text-template ^4.0.1
phpunit/php-timer ^7.0.1
sebastian/cli-parser ^3.0.2
sebastian/code-unit ^3.0.3
sebastian/comparator ^6.3.3
sebastian/diff ^6.0.2
sebastian/environment ^7.2.1
sebastian/exporter ^6.3.2
sebastian/global-state ^7.0.2
sebastian/object-enumerator ^6.0.1
sebastian/recursion-context ^6.0.3
sebastian/type ^5.1.3
sebastian/version ^5.0.2
staabm/side-effects-detector ^1.0.5
suggests
ext-soap To be able to generate mocks based on WSDL files
Expand
Listen
Show thinking
Gemini said
Gemini said
Assessment: Safe
Assessment: Safe
Based on the terminal output you provided, your Laravel project is
not vulnerable
to CVE-2026-24765.
Your Installed Version:
11.5.55
Secure Patched Version:
11.5.50
(for the 11.x release branch)
Because you are running
11.5.55
, which is newer than the required security patch, the unsafe deserialization flaw in the
cleanupForCoverage()
method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.
A quick reminder on best practices:
Since you are running this inside a Docker container (
docker_lamp_1
), just ensure that when you build your production container images, you continue to use the
--no-dev
flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to:
Sidebar
Sidebar...
|
32956
|
NULL
|
NULL
|
NULL
|
|
33107
|
1265
|
10
|
2026-05-13T10:04:25.109363+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666665109_m2.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
jiminny.atlassian.net/browse/JY-19957?search_id=d4 jiminny.atlassian.net/browse/JY-19957?search_id=d436a87d-f5b4-44e0-9541-4471b4b44c1c...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit
name : phpunit/phpunit
descrip. : The PHP Unit Testing framework.
keywords : phpunit, testing, xunit
versions : * 11.5.55
type : library
license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText
homepage : https://phpunit.de/
source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00
dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00
path : /home/jiminny/vendor/phpunit/phpunit
names : phpunit/phpunit
support
issues : https://github.com/sebastianbergmann/phpunit/issues
security : https://github.com/sebastianbergmann/phpunit/security/policy
source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55
autoload
files
classmap
src/
requires
ext-dom *
ext-json *
ext-libxml *
ext-mbstring *
ext-xml *
ext-xmlwriter *
myclabs/deep-copy ^1.13.4
phar-io/manifest ^2.0.4
phar-io/version ^3.2.1
php >=8.2
phpunit/php-code-coverage ^11.0.12
phpunit/php-file-iterator ^5.1.1
phpunit/php-invoker ^5.0.1
phpunit/php-text-template ^4.0.1
phpunit/php-timer ^7.0.1
sebastian/cli-parser ^3.0.2
sebastian/code-unit ^3.0.3
sebastian/comparator ^6.3.3
sebastian/diff ^6.0.2
sebastian/environment ^7.2.1
sebastian/exporter ^6.3.2
sebastian/global-state ^7.0.2
sebastian/object-enumerator ^6.0.1
sebastian/recursion-context ^6.0.3
sebastian/type ^5.1.3
sebastian/version ^5.0.2
staabm/side-effects-detector ^1.0.5
suggests
ext-soap To be able to generate mocks based on WSDL files
Expand
Listen
Show thinking
Gemini said
Gemini said
Assessment: Safe
Assessment: Safe
Based on the terminal output you provided, your Laravel project is
not vulnerable
to CVE-2026-24765.
Your Installed Version:
11.5.55
Secure Patched Version:
11.5.50
(for the 11.x release branch)
Because you are running
11.5.55
, which is newer than the required security patch, the unsafe deserialization flaw in the
cleanupForCoverage()
method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.
A quick reminder on best practices:
Since you are running this inside a Docker container (
docker_lamp_1
), just ensure that when you build your production container images, you continue to use the
--no-dev
flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to:
Sidebar
Sidebar
Top Bar
Top Bar
Main Content
Main Content
Collapse sidebar [
Collapse sidebar [
Switch sites or apps
Switch sites or apps
Go to your Jira homepage
Upgrade
Upgrade
Create
Create
Rovo Ask Rovo
Ask Rovo
8 Notifications
8 Notifications
Help
Help
Settings
Settings
[EMAIL]...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.5171588,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"7.8 (High)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requirement:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Resolution and Mitigation","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Resolution and Mitigation","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Official Patch:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The maintainer updated PHPUnit to treat pre-existing","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files as an error condition rather than attempting to sanitize and process them.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Recommended Actions:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"* Update PHPUnit to the latest patched version in your respective release branch.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Enforce code reviews and branch protection to prevent malicious file injection.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I fix these vulnareabilities in laravel project","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I fix these vulnareabilities in laravel project","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly how to secure your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check Your Current Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check Your Current Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer show phpunit/phpunit","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Look at the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"line in the output to see if you are running a vulnerable version (anything lower than 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Update PHPUnit","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Update PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tell Composer to update PHPUnit and its associated dependencies to the latest secure versions allowed by your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"constraints:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer update phpunit/phpunit --with-dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Note: If your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"restricts PHPUnit to an older major version (like","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"^9.0","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), Composer will automatically grab the secure patch for that specific major version (e.g., 9.6.33).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Verify the Fix","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Verify the Fix","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer show","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"command from step one again to confirm the version has been bumped. As long as your version is at or above one of the secure releases listed above, you are protected against CVE-2026-24765.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Secure Your Environments","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Secure Your Environments","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because PHPUnit lives in the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"require-dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"block of your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", this vulnerability does not impact your production environment—","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"provided you are deploying correctly","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Always build your production environment using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer install --no-dev --optimize-autoloader","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". This ensures testing frameworks are completely excluded from your live servers.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"For your CI/CD pipelines, ensure you are using ephemeral runners (runners that spin up fresh for every job and are destroyed afterward) so that an attacker cannot leave a malicious","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file behind for a subsequent test run to execute.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Would you like me to walk you through how to verify that your production server is completely free of development dependencies?","depth":24,"bounds":{"left":0.08959442,"top":0.0,"width":0.11502659,"height":0.057861134},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.086269945,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.09690824,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.107546546,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.11818484,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.12882313,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.1022274,"top":0.045889866,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.116855055,"top":0.045889866,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said root@docker_lamp_1:/home/jiminny# composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText homepage : https://phpunit.de/ source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00 dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00 path : /home/jiminny/vendor/phpunit/phpunit names : phpunit/phpunit support issues : https://github.com/sebastianbergmann/phpunit/issues security : https://github.com/sebastianbergmann/phpunit/security/policy source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55 autoload files classmap src/ requires ext-dom * ext-json * ext-libxml * ext-mbstring * ext-xml * ext-xmlwriter * myclabs/deep-copy ^1.13.4 phar-io/manifest ^2.0.4 phar-io/version ^3.2.1 php >=8.2 phpunit/php-code-coverage ^11.0.12 phpunit/php-file-iterator ^5.1.1 phpunit/php-invoker ^5.0.1 phpunit/php-text-template ^4.0.1 phpunit/php-timer ^7.0.1 sebastian/cli-parser ^3.0.2 sebastian/code-unit ^3.0.3 sebastian/comparator ^6.3.3 sebastian/diff ^6.0.2 sebastian/environment ^7.2.1 sebastian/exporter ^6.3.2 sebastian/global-state ^7.0.2 sebastian/object-enumerator ^6.0.1 sebastian/recursion-context ^6.0.3 sebastian/type ^5.1.3 sebastian/version ^5.0.2 staabm/side-effects-detector ^1.0.5 suggests ext-soap To be able to generate mocks based on WSDL files","depth":21,"bounds":{"left":0.13680187,"top":0.05546688,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.079288565,"top":0.056264963,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"root@docker_lamp_1:/home/jiminny# composer show phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.057063047,"width":0.051363032,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"name : phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.13367917,"width":0.04305186,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"descrip. : The PHP Unit Testing framework.","depth":23,"bounds":{"left":0.13680187,"top":0.1528332,"width":0.044049203,"height":0.054668795},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"keywords : phpunit, testing, xunit","depth":23,"bounds":{"left":0.13680187,"top":0.21029529,"width":0.046875,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions : * 11.5.55","depth":23,"bounds":{"left":0.13680187,"top":0.24860336,"width":0.04338431,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"type : library","depth":23,"bounds":{"left":0.13680187,"top":0.2677574,"width":0.035738032,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"license : BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText","depth":23,"bounds":{"left":0.13680187,"top":0.2869114,"width":0.051529255,"height":0.16959298},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"homepage : https://phpunit.de/","depth":23,"bounds":{"left":0.13680187,"top":0.4592977,"width":0.046875,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00","depth":23,"bounds":{"left":0.13680187,"top":0.49760574,"width":0.051529255,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00","depth":23,"bounds":{"left":0.13680187,"top":0.63168395,"width":0.051030584,"height":0.20790103},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"path : /home/jiminny/vendor/phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.8423783,"width":0.03856383,"height":0.054668795},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"names : phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.89984035,"width":0.044215426,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"support","depth":23,"bounds":{"left":0.13680187,"top":0.95730245,"width":0.018949468,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"issues : https://github.com/sebastianbergmann/phpunit/issues","depth":23,"bounds":{"left":0.13680187,"top":0.9764565,"width":0.049534574,"height":0.023543477},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"security : https://github.com/sebastianbergmann/phpunit/security/policy","depth":23,"bounds":{"left":0.13680187,"top":1.0,"width":0.049534574,"height":-0.05307257},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"autoload","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"classmap","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"src/","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"requires","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-dom *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-json *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-libxml *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-mbstring *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-xml *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-xmlwriter *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"myclabs/deep-copy ^1.13.4","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phar-io/manifest ^2.0.4","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phar-io/version ^3.2.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php >=8.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-code-coverage ^11.0.12","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-file-iterator ^5.1.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-invoker ^5.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-text-template ^4.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-timer ^7.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/cli-parser ^3.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/code-unit ^3.0.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/comparator ^6.3.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/diff ^6.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/environment ^7.2.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/exporter ^6.3.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/global-state ^7.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/object-enumerator ^6.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/recursion-context ^6.0.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/type ^5.1.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/version ^5.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"staabm/side-effects-detector ^1.0.5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"suggests","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-soap To be able to generate mocks based on WSDL files","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.18866356,"top":0.05546688,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.1939827,"top":0.18316041,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.10289229,"top":0.18555467,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.10056516,"top":0.22705507,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.10056516,"top":0.22905028,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Assessment: Safe","depth":23,"bounds":{"left":0.08959442,"top":0.22785315,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Assessment: Safe","depth":24,"bounds":{"left":0.08959442,"top":0.22944932,"width":0.045711435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Based on the terminal output you provided, your Laravel project is","depth":24,"bounds":{"left":0.08959442,"top":0.25578612,"width":0.105884306,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not vulnerable","depth":24,"bounds":{"left":0.14428191,"top":0.27653632,"width":0.03756649,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CVE-2026-24765.","depth":24,"bounds":{"left":0.08959442,"top":0.27653632,"width":0.099734046,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Your Installed Version:","depth":26,"bounds":{"left":0.1022274,"top":0.32681563,"width":0.057347074,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.55","depth":27,"bounds":{"left":0.16289894,"top":0.32801276,"width":0.019614361,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Secure Patched Version:","depth":26,"bounds":{"left":0.1022274,"top":0.35634476,"width":0.062832445,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.50","depth":27,"bounds":{"left":0.16855054,"top":0.3575419,"width":0.019448139,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(for the 11.x release branch)","depth":26,"bounds":{"left":0.1022274,"top":0.35634476,"width":0.09923537,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because you are running","depth":24,"bounds":{"left":0.08959442,"top":0.41061452,"width":0.061170213,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.55","depth":25,"bounds":{"left":0.15275931,"top":0.41181165,"width":0.019614361,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is newer than the required security patch, the unsafe deserialization flaw in the","depth":24,"bounds":{"left":0.08959442,"top":0.41061452,"width":0.108211435,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":25,"bounds":{"left":0.09158909,"top":0.47406226,"width":0.055851065,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.","depth":24,"bounds":{"left":0.08959442,"top":0.47286513,"width":0.11037234,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A quick reminder on best practices:","depth":24,"bounds":{"left":0.08959442,"top":0.5718276,"width":0.09225399,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Since you are running this inside a Docker container (","depth":24,"bounds":{"left":0.08959442,"top":0.5925778,"width":0.1022274,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker_lamp_1","depth":25,"bounds":{"left":0.11768617,"top":0.61452514,"width":0.036402926,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), just ensure that when you build your production container images, you continue to use the","depth":24,"bounds":{"left":0.08959442,"top":0.61332804,"width":0.1100399,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"--no-dev","depth":25,"bounds":{"left":0.1697141,"top":0.6560255,"width":0.022273935,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.","depth":24,"bounds":{"left":0.08959442,"top":0.6548284,"width":0.11502659,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":21,"bounds":{"left":0.086269945,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":21,"bounds":{"left":0.09690824,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Redo","depth":21,"bounds":{"left":0.107546546,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Share & export","depth":20,"bounds":{"left":0.11818484,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":21,"bounds":{"left":0.12882313,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":20,"bounds":{"left":0.13946144,"top":0.75059855,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXTextArea","text":"Enter a prompt for Gemini\nencrypted","depth":20,"bounds":{"left":0.09291888,"top":0.8216281,"width":0.10638298,"height":0.01915403},"on_screen":true,"value":"Enter a prompt for Gemini\nencrypted","help_text":"","role_description":"text entry area","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Enter a prompt for Gemini","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"encrypted","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open upload file menu","depth":20,"bounds":{"left":0.08892952,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Tools","depth":18,"bounds":{"left":0.10488697,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Open mode picker","depth":20,"bounds":{"left":0.1619016,"top":0.85514766,"width":0.026097074,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Pro","depth":23,"bounds":{"left":0.16722074,"top":0.8639266,"width":0.007480053,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Microphone","depth":19,"bounds":{"left":0.18999335,"top":0.85514766,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Send message","depth":19,"bounds":{"left":0.19630983,"top":0.85434955,"width":0.013962766,"height":0.033519555},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":false,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.","depth":17,"bounds":{"left":0.08510638,"top":0.90901834,"width":0.11951463,"height":0.025139665},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Your privacy & Gemini Opens in a new window","depth":17,"bounds":{"left":0.16705452,"top":0.92178774,"width":0.040059842,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Your privacy & Gemini","depth":18,"bounds":{"left":0.16705452,"top":0.92178774,"width":0.040059842,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Opens in a new window","depth":19,"bounds":{"left":0.079288565,"top":0.92098963,"width":0.043218084,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Summarize page","depth":7,"bounds":{"left":0.08494016,"top":0.95730245,"width":0.053523935,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Summarize page","depth":9,"bounds":{"left":0.09059176,"top":0.96249,"width":0.042220745,"height":0.015163607},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Skip to:","depth":9,"bounds":{"left":0.22606383,"top":0.07861133,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Sidebar","depth":10,"bounds":{"left":0.22606383,"top":0.097765364,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Sidebar","depth":11,"bounds":{"left":0.22606383,"top":0.097765364,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Top Bar","depth":10,"bounds":{"left":0.22606383,"top":0.11691939,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Top Bar","depth":11,"bounds":{"left":0.22606383,"top":0.11691939,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Main Content","depth":10,"bounds":{"left":0.22606383,"top":0.13607343,"width":0.029421542,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Main Content","depth":11,"bounds":{"left":0.22606383,"top":0.13607343,"width":0.029421542,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Collapse sidebar [","depth":9,"bounds":{"left":0.21941489,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Collapse sidebar [","depth":11,"bounds":{"left":0.22456782,"top":0.06344773,"width":0.039727394,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Switch sites or apps","depth":10,"bounds":{"left":0.23138298,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Switch sites or apps","depth":12,"bounds":{"left":0.2365359,"top":0.06344773,"width":0.044215426,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Go to your Jira homepage","depth":9,"bounds":{"left":0.24468085,"top":0.057861134,"width":0.029421542,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXComboBox","text":"Upgrade","depth":11,"bounds":{"left":0.47273937,"top":0.06264964,"width":0.24268617,"height":0.015961692},"on_screen":true,"value":"Upgrade","help_text":"","placeholder":"Search","role_description":"combo box","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Upgrade","depth":12,"bounds":{"left":0.47273937,"top":0.06384677,"width":0.019115692,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Create","depth":10,"bounds":{"left":0.7237367,"top":0.057861134,"width":0.030086435,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Create","depth":12,"bounds":{"left":0.7350399,"top":0.06384677,"width":0.014793883,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Rovo Ask Rovo","depth":12,"bounds":{"left":0.91240025,"top":0.057861134,"width":0.035904255,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Ask Rovo","depth":14,"bounds":{"left":0.92370343,"top":0.06384677,"width":0.020611702,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"8 Notifications","depth":12,"bounds":{"left":0.9496343,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"8 Notifications","depth":14,"bounds":{"left":0.95478725,"top":0.06344773,"width":0.031914894,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Help","depth":12,"bounds":{"left":0.9616024,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Help","depth":14,"bounds":{"left":0.96675533,"top":0.06344773,"width":0.010139627,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Settings","depth":12,"bounds":{"left":0.97357047,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Settings","depth":14,"bounds":{"left":0.9787234,"top":0.06344773,"width":0.017952127,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.98553854,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false}]...
|
-6927739817853041957
|
-2657126045375447166
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit
name : phpunit/phpunit
descrip. : The PHP Unit Testing framework.
keywords : phpunit, testing, xunit
versions : * 11.5.55
type : library
license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText
homepage : https://phpunit.de/
source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00
dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00
path : /home/jiminny/vendor/phpunit/phpunit
names : phpunit/phpunit
support
issues : https://github.com/sebastianbergmann/phpunit/issues
security : https://github.com/sebastianbergmann/phpunit/security/policy
source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55
autoload
files
classmap
src/
requires
ext-dom *
ext-json *
ext-libxml *
ext-mbstring *
ext-xml *
ext-xmlwriter *
myclabs/deep-copy ^1.13.4
phar-io/manifest ^2.0.4
phar-io/version ^3.2.1
php >=8.2
phpunit/php-code-coverage ^11.0.12
phpunit/php-file-iterator ^5.1.1
phpunit/php-invoker ^5.0.1
phpunit/php-text-template ^4.0.1
phpunit/php-timer ^7.0.1
sebastian/cli-parser ^3.0.2
sebastian/code-unit ^3.0.3
sebastian/comparator ^6.3.3
sebastian/diff ^6.0.2
sebastian/environment ^7.2.1
sebastian/exporter ^6.3.2
sebastian/global-state ^7.0.2
sebastian/object-enumerator ^6.0.1
sebastian/recursion-context ^6.0.3
sebastian/type ^5.1.3
sebastian/version ^5.0.2
staabm/side-effects-detector ^1.0.5
suggests
ext-soap To be able to generate mocks based on WSDL files
Expand
Listen
Show thinking
Gemini said
Gemini said
Assessment: Safe
Assessment: Safe
Based on the terminal output you provided, your Laravel project is
not vulnerable
to CVE-2026-24765.
Your Installed Version:
11.5.55
Secure Patched Version:
11.5.50
(for the 11.x release branch)
Because you are running
11.5.55
, which is newer than the required security patch, the unsafe deserialization flaw in the
cleanupForCoverage()
method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.
A quick reminder on best practices:
Since you are running this inside a Docker container (
docker_lamp_1
), just ensure that when you build your production container images, you continue to use the
--no-dev
flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to:
Sidebar
Sidebar
Top Bar
Top Bar
Main Content
Main Content
Collapse sidebar [
Collapse sidebar [
Switch sites or apps
Switch sites or apps
Go to your Jira homepage
Upgrade
Upgrade
Create
Create
Rovo Ask Rovo
Ask Rovo
8 Notifications
8 Notifications
Help
Help
Settings
Settings
[EMAIL]...
|
33106
|
NULL
|
NULL
|
NULL
|
|
33108
|
1264
|
10
|
2026-05-13T10:04:25.771209+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666665771_m1.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
jiminny.atlassian.net/browse/JY-19957?search_id=d4 jiminny.atlassian.net/browse/JY-19957?search_id=d436a87d-f5b4-44e0-9541-4471b4b44c1c...
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment
Risk Assessment
CVSS Score:
7.8 (High)
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requirement:
Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.
Resolution and Mitigation
Resolution and Mitigation
Official Patch:
The maintainer updated PHPUnit to treat pre-existing
.coverage
files as an error condition rather than attempting to sanitize and process them.
Recommended Actions:
* Update PHPUnit to the latest patched version in your respective release branch.
Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.
Enforce code reviews and branch protection to prevent malicious file injection.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I fix these vulnareabilities in laravel project
You said
how can I fix these vulnareabilities in laravel project
Listen
Show thinking
Gemini said
Gemini said
Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.
Here is exactly how to secure your project:
1. Check Your Current Version
1. Check Your Current Version
First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:
Bash
Download code
Copy code
composer show phpunit/phpunit
Look at the
versions
line in the output to see if you are running a vulnerable version (anything lower than 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52).
2. Update PHPUnit
2. Update PHPUnit
Tell Composer to update PHPUnit and its associated dependencies to the latest secure versions allowed by your
composer.json
constraints:
Bash
Download code
Copy code
composer update phpunit/phpunit --with-dependencies
Note: If your
composer.json
restricts PHPUnit to an older major version (like
^9.0
), Composer will automatically grab the secure patch for that specific major version (e.g., 9.6.33).
3. Verify the Fix
3. Verify the Fix
Run the
composer show
command from step one again to confirm the version has been bumped. As long as your version is at or above one of the secure releases listed above, you are protected against CVE-2026-24765.
4. Secure Your Environments
4. Secure Your Environments
Because PHPUnit lives in the
require-dev
block of your
composer.json
, this vulnerability does not impact your production environment—
provided you are deploying correctly
....
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"7.8 (High)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requirement:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Resolution and Mitigation","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Resolution and Mitigation","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Official Patch:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The maintainer updated PHPUnit to treat pre-existing","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files as an error condition rather than attempting to sanitize and process them.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Recommended Actions:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"* Update PHPUnit to the latest patched version in your respective release branch.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Enforce code reviews and branch protection to prevent malicious file injection.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I fix these vulnareabilities in laravel project","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I fix these vulnareabilities in laravel project","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly how to secure your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check Your Current Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check Your Current Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer show phpunit/phpunit","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Look at the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"line in the output to see if you are running a vulnerable version (anything lower than 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Update PHPUnit","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Update PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tell Composer to update PHPUnit and its associated dependencies to the latest secure versions allowed by your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"constraints:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer update phpunit/phpunit --with-dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Note: If your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"restricts PHPUnit to an older major version (like","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"^9.0","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), Composer will automatically grab the secure patch for that specific major version (e.g., 9.6.33).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Verify the Fix","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Verify the Fix","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer show","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"command from step one again to confirm the version has been bumped. As long as your version is at or above one of the secure releases listed above, you are protected against CVE-2026-24765.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Secure Your Environments","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Secure Your Environments","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because PHPUnit lives in the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"require-dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"block of your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", this vulnerability does not impact your production environment—","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"provided you are deploying correctly","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
5884636234907115533
|
-2436528811300012410
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment
Risk Assessment
CVSS Score:
7.8 (High)
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requirement:
Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.
Resolution and Mitigation
Resolution and Mitigation
Official Patch:
The maintainer updated PHPUnit to treat pre-existing
.coverage
files as an error condition rather than attempting to sanitize and process them.
Recommended Actions:
* Update PHPUnit to the latest patched version in your respective release branch.
Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.
Enforce code reviews and branch protection to prevent malicious file injection.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I fix these vulnareabilities in laravel project
You said
how can I fix these vulnareabilities in laravel project
Listen
Show thinking
Gemini said
Gemini said
Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.
Here is exactly how to secure your project:
1. Check Your Current Version
1. Check Your Current Version
First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:
Bash
Download code
Copy code
composer show phpunit/phpunit
Look at the
versions
line in the output to see if you are running a vulnerable version (anything lower than 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52).
2. Update PHPUnit
2. Update PHPUnit
Tell Composer to update PHPUnit and its associated dependencies to the latest secure versions allowed by your
composer.json
constraints:
Bash
Download code
Copy code
composer update phpunit/phpunit --with-dependencies
Note: If your
composer.json
restricts PHPUnit to an older major version (like
^9.0
), Composer will automatically grab the secure patch for that specific major version (e.g., 9.6.33).
3. Verify the Fix
3. Verify the Fix
Run the
composer show
command from step one again to confirm the version has been bumped. As long as your version is at or above one of the secure releases listed above, you are protected against CVE-2026-24765.
4. Secure Your Environments
4. Secure Your Environments
Because PHPUnit lives in the
require-dev
block of your
composer.json
, this vulnerability does not impact your production environment—
provided you are deploying correctly
....
|
33105
|
NULL
|
NULL
|
NULL
|
|
33109
|
1264
|
11
|
2026-05-13T10:04:28.800047+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666668800_m1.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
jiminny.atlassian.net/browse/JY-19957?search_id=d4 jiminny.atlassian.net/browse/JY-19957?search_id=d436a87d-f5b4-44e0-9541-4471b4b44c1c...
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit
name : phpunit/phpunit
descrip. : The PHP Unit Testing framework.
keywords : phpunit, testing, xunit
versions : * 11.5.55
type : library
license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText
homepage : https://phpunit.de/
source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00
dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00
path : /home/jiminny/vendor/phpunit/phpunit
names : phpunit/phpunit
support
issues : https://github.com/sebastianbergmann/phpunit/issues
security : https://github.com/sebastianbergmann/phpunit/security/policy
source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55
autoload
files
classmap
src/
requires
ext-dom *
ext-json *
ext-libxml *
ext-mbstring *
ext-xml *
ext-xmlwriter *
myclabs/deep-copy ^1.13.4
phar-io/manifest ^2.0.4
phar-io/version ^3.2.1
php >=8.2
phpunit/php-code-coverage ^11.0.12
phpunit/php-file-iterator ^5.1.1
phpunit/php-invoker ^5.0.1
phpunit/php-text-template ^4.0.1
phpunit/php-timer ^7.0.1
sebastian/cli-parser ^3.0.2
sebastian/code-unit ^3.0.3
sebastian/comparator ^6.3.3
sebastian/diff ^6.0.2
sebastian/environment ^7.2.1
sebastian/exporter ^6.3.2
sebastian/global-state ^7.0.2
sebastian/object-enumerator ^6.0.1
sebastian/recursion-context ^6.0.3
sebastian/type ^5.1.3
sebastian/version ^5.0.2
staabm/side-effects-detector ^1.0.5
suggests
ext-soap To be able to generate mocks based on WSDL files
Expand
Listen
Show thinking
Gemini said
Gemini said
Assessment: Safe
Assessment: Safe
Based on the terminal output you provided, your Laravel project is
not vulnerable
to CVE-2026-24765.
Your Installed Version:
11.5.55
Secure Patched Version:
11.5.50
(for the 11.x release branch)
Because you are running
11.5.55
, which is newer than the required security patch, the unsafe deserialization flaw in the
cleanupForCoverage()
method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.
A quick reminder on best practices:
Since you are running this inside a Docker container (
docker_lamp_1
), just ensure that when you build your production container images, you continue to use the
--no-dev
flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to:
Sidebar
Sidebar
Top Bar
Top Bar
Main Content
Main Content
Collapse sidebar [
Collapse sidebar [
Switch sites or apps
Switch sites or apps
Go to your Jira homepage
Upgrade
Upgrade
Create
Create
Rovo Ask Rovo
Ask Rovo
8 Notifications
8 Notifications
Help
Help
Settings
Settings
[EMAIL]
[EMAIL]
For you
For you
Recent
Recent
Starred
Starred
Apps
Apps
More actions for Apps
More actions for Apps...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"7.8 (High)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requirement:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Resolution and Mitigation","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Resolution and Mitigation","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Official Patch:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The maintainer updated PHPUnit to treat pre-existing","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files as an error condition rather than attempting to sanitize and process them.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Recommended Actions:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"* Update PHPUnit to the latest patched version in your respective release branch.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Enforce code reviews and branch protection to prevent malicious file injection.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I fix these vulnareabilities in laravel project","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I fix these vulnareabilities in laravel project","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly how to secure your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check Your Current Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check Your Current Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer show phpunit/phpunit","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Look at the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"line in the output to see if you are running a vulnerable version (anything lower than 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Update PHPUnit","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Update PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tell Composer to update PHPUnit and its associated dependencies to the latest secure versions allowed by your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"constraints:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer update phpunit/phpunit --with-dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Note: If your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"restricts PHPUnit to an older major version (like","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"^9.0","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), Composer will automatically grab the secure patch for that specific major version (e.g., 9.6.33).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Verify the Fix","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Verify the Fix","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer show","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"command from step one again to confirm the version has been bumped. As long as your version is at or above one of the secure releases listed above, you are protected against CVE-2026-24765.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Secure Your Environments","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Secure Your Environments","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because PHPUnit lives in the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"require-dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"block of your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", this vulnerability does not impact your production environment—","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"provided you are deploying correctly","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Always build your production environment using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer install --no-dev --optimize-autoloader","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". This ensures testing frameworks are completely excluded from your live servers.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"For your CI/CD pipelines, ensure you are using ephemeral runners (runners that spin up fresh for every job and are destroyed afterward) so that an attacker cannot leave a malicious","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file behind for a subsequent test run to execute.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Would you like me to walk you through how to verify that your production server is completely free of development dependencies?","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said root@docker_lamp_1:/home/jiminny# composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText homepage : https://phpunit.de/ source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00 dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00 path : /home/jiminny/vendor/phpunit/phpunit names : phpunit/phpunit support issues : https://github.com/sebastianbergmann/phpunit/issues security : https://github.com/sebastianbergmann/phpunit/security/policy source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55 autoload files classmap src/ requires ext-dom * ext-json * ext-libxml * ext-mbstring * ext-xml * ext-xmlwriter * myclabs/deep-copy ^1.13.4 phar-io/manifest ^2.0.4 phar-io/version ^3.2.1 php >=8.2 phpunit/php-code-coverage ^11.0.12 phpunit/php-file-iterator ^5.1.1 phpunit/php-invoker ^5.0.1 phpunit/php-text-template ^4.0.1 phpunit/php-timer ^7.0.1 sebastian/cli-parser ^3.0.2 sebastian/code-unit ^3.0.3 sebastian/comparator ^6.3.3 sebastian/diff ^6.0.2 sebastian/environment ^7.2.1 sebastian/exporter ^6.3.2 sebastian/global-state ^7.0.2 sebastian/object-enumerator ^6.0.1 sebastian/recursion-context ^6.0.3 sebastian/type ^5.1.3 sebastian/version ^5.0.2 staabm/side-effects-detector ^1.0.5 suggests ext-soap To be able to generate mocks based on WSDL files","depth":21,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"root@docker_lamp_1:/home/jiminny# composer show phpunit/phpunit","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"name : phpunit/phpunit","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"descrip. : The PHP Unit Testing framework.","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"keywords : phpunit, testing, xunit","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions : * 11.5.55","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"type : library","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"license : BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"homepage : https://phpunit.de/","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"path : /home/jiminny/vendor/phpunit/phpunit","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"names : phpunit/phpunit","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"support","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"issues : https://github.com/sebastianbergmann/phpunit/issues","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"security : https://github.com/sebastianbergmann/phpunit/security/policy","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"autoload","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"classmap","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"src/","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"requires","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-dom *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-json *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-libxml *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-mbstring *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-xml *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-xmlwriter *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"myclabs/deep-copy ^1.13.4","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phar-io/manifest ^2.0.4","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phar-io/version ^3.2.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php >=8.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-code-coverage ^11.0.12","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-file-iterator ^5.1.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-invoker ^5.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-text-template ^4.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phpunit/php-timer ^7.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/cli-parser ^3.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/code-unit ^3.0.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/comparator ^6.3.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/diff ^6.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/environment ^7.2.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/exporter ^6.3.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/global-state ^7.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/object-enumerator ^6.0.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/recursion-context ^6.0.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/type ^5.1.3","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sebastian/version ^5.0.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"staabm/side-effects-detector ^1.0.5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"suggests","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-soap To be able to generate mocks based on WSDL files","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Assessment: Safe","depth":23,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Assessment: Safe","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Based on the terminal output you provided, your Laravel project is","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not vulnerable","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CVE-2026-24765.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Your Installed Version:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.55","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Secure Patched Version:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.50","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(for the 11.x release branch)","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because you are running","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.5.55","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is newer than the required security patch, the unsafe deserialization flaw in the","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A quick reminder on best practices:","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Since you are running this inside a Docker container (","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker_lamp_1","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), just ensure that when you build your production container images, you continue to use the","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"--no-dev","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":21,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":21,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Redo","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Share & export","depth":20,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":20,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXTextArea","text":"Enter a prompt for Gemini\nencrypted","depth":20,"on_screen":true,"value":"Enter a prompt for Gemini\nencrypted","help_text":"","role_description":"text entry area","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Enter a prompt for Gemini","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"encrypted","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open upload file menu","depth":20,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Tools","depth":18,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Open mode picker","depth":20,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Pro","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Microphone","depth":19,"on_screen":true,"role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Send message","depth":19,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":false,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.","depth":17,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Your privacy & Gemini Opens in a new window","depth":17,"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Your privacy & Gemini","depth":18,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Opens in a new window","depth":19,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Summarize page","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Summarize page","depth":9,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Skip to:","depth":9,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Sidebar","depth":10,"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Sidebar","depth":11,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Top Bar","depth":10,"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Top Bar","depth":11,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Main Content","depth":10,"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Main Content","depth":11,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Collapse sidebar [","depth":9,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Collapse sidebar [","depth":11,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Switch sites or apps","depth":10,"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Switch sites or apps","depth":12,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Go to your Jira homepage","depth":9,"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXComboBox","text":"Upgrade","depth":11,"on_screen":true,"value":"Upgrade","help_text":"","placeholder":"Search","role_description":"combo box","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Upgrade","depth":12,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Create","depth":10,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Create","depth":12,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Rovo Ask Rovo","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Ask Rovo","depth":14,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"8 Notifications","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"8 Notifications","depth":14,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Help","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Help","depth":14,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Settings","depth":12,"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Settings","depth":14,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"lukas.kovalik@jiminny.com","depth":14,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"For you","depth":12,"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"For you","depth":15,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Recent","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Recent","depth":15,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Starred","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Starred","depth":15,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Apps","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Apps","depth":15,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"More actions for Apps","depth":13,"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"More actions for Apps","depth":15,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-7011046114176038620
|
-2657126114061369470
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit
name : phpunit/phpunit
descrip. : The PHP Unit Testing framework.
keywords : phpunit, testing, xunit
versions : * 11.5.55
type : library
license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText
homepage : https://phpunit.de/
source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00
dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00
path : /home/jiminny/vendor/phpunit/phpunit
names : phpunit/phpunit
support
issues : https://github.com/sebastianbergmann/phpunit/issues
security : https://github.com/sebastianbergmann/phpunit/security/policy
source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55
autoload
files
classmap
src/
requires
ext-dom *
ext-json *
ext-libxml *
ext-mbstring *
ext-xml *
ext-xmlwriter *
myclabs/deep-copy ^1.13.4
phar-io/manifest ^2.0.4
phar-io/version ^3.2.1
php >=8.2
phpunit/php-code-coverage ^11.0.12
phpunit/php-file-iterator ^5.1.1
phpunit/php-invoker ^5.0.1
phpunit/php-text-template ^4.0.1
phpunit/php-timer ^7.0.1
sebastian/cli-parser ^3.0.2
sebastian/code-unit ^3.0.3
sebastian/comparator ^6.3.3
sebastian/diff ^6.0.2
sebastian/environment ^7.2.1
sebastian/exporter ^6.3.2
sebastian/global-state ^7.0.2
sebastian/object-enumerator ^6.0.1
sebastian/recursion-context ^6.0.3
sebastian/type ^5.1.3
sebastian/version ^5.0.2
staabm/side-effects-detector ^1.0.5
suggests
ext-soap To be able to generate mocks based on WSDL files
Expand
Listen
Show thinking
Gemini said
Gemini said
Assessment: Safe
Assessment: Safe
Based on the terminal output you provided, your Laravel project is
not vulnerable
to CVE-2026-24765.
Your Installed Version:
11.5.55
Secure Patched Version:
11.5.50
(for the 11.x release branch)
Because you are running
11.5.55
, which is newer than the required security patch, the unsafe deserialization flaw in the
cleanupForCoverage()
method has already been resolved in your environment. You don't need to take any further action to upgrade PHPUnit for this specific CVE.
A quick reminder on best practices:
Since you are running this inside a Docker container (
docker_lamp_1
), just ensure that when you build your production container images, you continue to use the
--no-dev
flag with Composer. This guarantees that PHPUnit is entirely excluded from your live production environments.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to:
Sidebar
Sidebar
Top Bar
Top Bar
Main Content
Main Content
Collapse sidebar [
Collapse sidebar [
Switch sites or apps
Switch sites or apps
Go to your Jira homepage
Upgrade
Upgrade
Create
Create
Rovo Ask Rovo
Ask Rovo
8 Notifications
8 Notifications
Help
Help
Settings
Settings
[EMAIL]
[EMAIL]
For you
For you
Recent
Recent
Starred
Starred
Apps
Apps
More actions for Apps
More actions for Apps...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
33118
|
1264
|
16
|
2026-05-13T10:04:50.027878+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666690027_m1.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
jiminny.atlassian.net/browse/JY-19957?search_id=d4 jiminny.atlassian.net/browse/JY-19957?search_id=d436a87d-f5b4-44e0-9541-4471b4b44c1c...
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment
Risk Assessment
CVSS Score:
7.8 (High)
Vector:...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"7.8 (High)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-2957900927802609697
|
-130685802053026682
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment
Risk Assessment
CVSS Score:
7.8 (High)
Vector:...
|
33117
|
NULL
|
NULL
|
NULL
|
|
33119
|
1265
|
15
|
2026-05-13T10:04:51.076037+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666691076_m2.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
jiminny.atlassian.net/browse/JY-19957?search_id=d4 jiminny.atlassian.net/browse/JY-19957?search_id=d436a87d-f5b4-44e0-9541-4471b4b44c1c...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Close tab
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.5171588,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.61532325,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
4212330714054406787
|
-419188993479590778
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Close tab
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
33120
|
1264
|
17
|
2026-05-13T10:04:55.119834+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666695119_m1.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
6776201984285986669
|
-419188993479590778
|
click
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
33121
|
1265
|
16
|
2026-05-13T10:04:55.119736+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666695119_m2.jpg...
|
Firefox
|
[JY-19957] Upgrade BE libraries - Apr - Jira — Wor [JY-19957] Upgrade BE libraries - Apr - Jira — Work...
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.5171588,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.67517954,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
156716020256738038
|
-419188993479590778
|
click
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
Close tab
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL...
|
33119
|
NULL
|
NULL
|
NULL
|
|
33122
|
1265
|
17
|
2026-05-13T10:04:57.062028+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666697062_m2.jpg...
|
Firefox
|
Work — Mozilla Firefox
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Close tab
New Tab
New Tab
Close tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.074221864,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.08539505,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.10694334,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.11811652,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.1396648,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.15083799,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.17238627,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.18355946,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.20510775,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.21628092,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.23782921,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.2490024,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.27055067,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.28172386,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.30327216,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.31444532,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.33599362,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.3471668,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.36871508,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.37988827,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.40143654,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.41260973,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.43415803,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.44533122,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4668795,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.47805268,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.49960095,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.51077414,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.5323224,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5434956,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.56504387,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.57621706,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.5977654,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6089386,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.63048685,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.64166003,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6632083,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6743815,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.6703911,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.69592977,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.70710295,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.70311254,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.7302474,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.07741421,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.07741421,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.12609737,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.12609737,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.12609737,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.12609737,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.16999201,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.17238627,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.025139665,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.044293694,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.06344773,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.14006385,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.15921788,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.1783719,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.19752593,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.27414206,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.2932961,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.3124501,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.33160415,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.3507582,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.3699122,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.38906625,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.40822026,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.4273743,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.46568236,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.4848364,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
4730791838235508138
|
-419760739492479866
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Close tab
New Tab
New Tab
Close tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
33123
|
1265
|
18
|
2026-05-13T10:05:00.093853+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666700093_m2.jpg...
|
Firefox
|
Work — Mozilla Firefox
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Close tab
New Tab
New Tab
Close tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit
name : phpunit/phpunit
descrip. : The PHP Unit Testing framework.
keywords : phpunit, testing, xunit
versions : * 11.5.55
type : library
license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText
homepage : https://phpunit.de/
source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00
dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00
path : /home/jiminny/vendor/phpunit/phpunit
names : phpunit/phpunit
support
issues : https://github.com/sebastianbergmann/phpunit/issues
security : https://github.com/sebastianbergmann/phpunit/security/policy
source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55
autoload
files
classmap
src/
requires
ext-dom *
ext-json *
ext-libxml *
ext-mbstring *
ext-xml *
ext-xmlwriter *
myclabs/deep-copy ^1.13.4
phar-io/manifest ^2.0.4
phar-io/version ^3.2.1...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.074221864,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.08539505,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.10694334,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.11811652,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.1396648,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.15083799,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.17238627,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.18355946,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.20510775,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.21628092,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.23782921,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.2490024,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.27055067,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.28172386,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.30327216,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.31444532,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.33599362,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.3471668,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.36871508,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.37988827,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.40143654,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.41260973,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.43415803,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.44533122,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4668795,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.47805268,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.49960095,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.51077414,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.5323224,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5434956,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.56504387,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.57621706,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.5977654,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6089386,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.63048685,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.64166003,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6632083,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6743815,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.6703911,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.69592977,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.70710295,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.70311254,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.7302474,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.07741421,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.07741421,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.12609737,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.12609737,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.12609737,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.12609737,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.16999201,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.17238627,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.025139665,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.044293694,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.06344773,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.14006385,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.15921788,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.1783719,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.19752593,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.27414206,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.2932961,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.3124501,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.33160415,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.3507582,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.3699122,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.38906625,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.40822026,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.4273743,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.46568236,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.4848364,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5231444,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5422985,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.6189146,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.6955307,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7913009,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.887071,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9828412,"width":0.06565824,"height":0.017158806},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.09776533},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"7.8 (High)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requirement:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Resolution and Mitigation","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Resolution and Mitigation","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Official Patch:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The maintainer updated PHPUnit to treat pre-existing","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files as an error condition rather than attempting to sanitize and process them.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Recommended Actions:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"* Update PHPUnit to the latest patched version in your respective release branch.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Enforce code reviews and branch protection to prevent malicious file injection.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I fix these vulnareabilities in laravel project","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I fix these vulnareabilities in laravel project","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly how to secure your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check Your Current Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check Your Current Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer show phpunit/phpunit","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Look at the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"line in the output to see if you are running a vulnerable version (anything lower than 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Update PHPUnit","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Update PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tell Composer to update PHPUnit and its associated dependencies to the latest secure versions allowed by your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"constraints:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer update phpunit/phpunit --with-dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Note: If your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"restricts PHPUnit to an older major version (like","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"^9.0","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), Composer will automatically grab the secure patch for that specific major version (e.g., 9.6.33).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Verify the Fix","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Verify the Fix","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer show","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"command from step one again to confirm the version has been bumped. As long as your version is at or above one of the secure releases listed above, you are protected against CVE-2026-24765.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Secure Your Environments","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Secure Your Environments","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because PHPUnit lives in the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"require-dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"block of your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", this vulnerability does not impact your production environment—","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"provided you are deploying correctly","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Always build your production environment using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer install --no-dev --optimize-autoloader","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". This ensures testing frameworks are completely excluded from your live servers.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"For your CI/CD pipelines, ensure you are using ephemeral runners (runners that spin up fresh for every job and are destroyed afterward) so that an attacker cannot leave a malicious","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file behind for a subsequent test run to execute.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Would you like me to walk you through how to verify that your production server is completely free of development dependencies?","depth":24,"bounds":{"left":0.08959442,"top":0.0,"width":0.11502659,"height":0.057861134},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.086269945,"top":0.0075818035,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.09690824,"top":0.0075818035,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.107546546,"top":0.0075818035,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.11818484,"top":0.0075818035,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.12882313,"top":0.0075818035,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.1022274,"top":0.06823623,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.116855055,"top":0.06823623,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said root@docker_lamp_1:/home/jiminny# composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText homepage : https://phpunit.de/ source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00 dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00 path : /home/jiminny/vendor/phpunit/phpunit names : phpunit/phpunit support issues : https://github.com/sebastianbergmann/phpunit/issues security : https://github.com/sebastianbergmann/phpunit/security/policy source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55 autoload files classmap src/ requires ext-dom * ext-json * ext-libxml * ext-mbstring * ext-xml * ext-xmlwriter * myclabs/deep-copy ^1.13.4 phar-io/manifest ^2.0.4 phar-io/version ^3.2.1 php >=8.2 phpunit/php-code-coverage ^11.0.12 phpunit/php-file-iterator ^5.1.1 phpunit/php-invoker ^5.0.1 phpunit/php-text-template ^4.0.1 phpunit/php-timer ^7.0.1 sebastian/cli-parser ^3.0.2 sebastian/code-unit ^3.0.3 sebastian/comparator ^6.3.3 sebastian/diff ^6.0.2 sebastian/environment ^7.2.1 sebastian/exporter ^6.3.2 sebastian/global-state ^7.0.2 sebastian/object-enumerator ^6.0.1 sebastian/recursion-context ^6.0.3 sebastian/type ^5.1.3 sebastian/version ^5.0.2 staabm/side-effects-detector ^1.0.5 suggests ext-soap To be able to generate mocks based on WSDL files","depth":21,"bounds":{"left":0.13680187,"top":0.077813245,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.079288565,"top":0.07861133,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"root@docker_lamp_1:/home/jiminny# composer show phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.07940942,"width":0.051363032,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"name : phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.15602554,"width":0.04305186,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"descrip. : The PHP Unit Testing framework.","depth":23,"bounds":{"left":0.13680187,"top":0.17517957,"width":0.044049203,"height":0.054668795},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"keywords : phpunit, testing, xunit","depth":23,"bounds":{"left":0.13680187,"top":0.23264167,"width":0.046875,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions : * 11.5.55","depth":23,"bounds":{"left":0.13680187,"top":0.27094972,"width":0.04338431,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"type : library","depth":23,"bounds":{"left":0.13680187,"top":0.29010376,"width":0.035738032,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"license : BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText","depth":23,"bounds":{"left":0.13680187,"top":0.30925778,"width":0.051529255,"height":0.16959298},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"homepage : https://phpunit.de/","depth":23,"bounds":{"left":0.13680187,"top":0.48164406,"width":0.046875,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00","depth":23,"bounds":{"left":0.13680187,"top":0.5199521,"width":0.051529255,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00","depth":23,"bounds":{"left":0.13680187,"top":0.6540303,"width":0.051030584,"height":0.20790103},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"path : /home/jiminny/vendor/phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.86472464,"width":0.03856383,"height":0.054668795},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"names : phpunit/phpunit","depth":23,"bounds":{"left":0.13680187,"top":0.92218673,"width":0.044215426,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"support","depth":23,"bounds":{"left":0.13680187,"top":0.9796488,"width":0.018949468,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"issues : https://github.com/sebastianbergmann/phpunit/issues","depth":23,"bounds":{"left":0.13680187,"top":0.9988029,"width":0.049534574,"height":0.0011970997},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"security : https://github.com/sebastianbergmann/phpunit/security/policy","depth":23,"bounds":{"left":0.13680187,"top":1.0,"width":0.049534574,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"autoload","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"classmap","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"src/","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"requires","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-dom *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-json *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-libxml *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-mbstring *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-xml *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"ext-xmlwriter *","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"myclabs/deep-copy ^1.13.4","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phar-io/manifest ^2.0.4","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"phar-io/version ^3.2.1","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
883983433538195789
|
-2359888469977645438
|
visual_change
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Close tab
New Tab
New Tab
Close tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit name : phpunit/phpunit descrip. : The PHP Unit Testing framework. keywords : phpunit, testing, xunit versions : * 11.5.55 type : library license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) [URL_WITH_CREDENTIALS] composer show phpunit/phpunit
name : phpunit/phpunit
descrip. : The PHP Unit Testing framework.
keywords : phpunit, testing, xunit
versions : * 11.5.55
type : library
license : BSD 3-Clause "New" or "Revised" License (BSD-3-Clause) (OSI approved) https://spdx.org/licenses/BSD-3-Clause.html#licenseText
homepage : https://phpunit.de/
source : [git] https://github.com/sebastianbergmann/phpunit.git adc7262fccc12de2b30f12a8aa0b33775d814f00
dist : [zip] https://api.github.com/repos/sebastianbergmann/phpunit/zipball/adc7262fccc12de2b30f12a8aa0b33775d814f00 adc7262fccc12de2b30f12a8aa0b33775d814f00
path : /home/jiminny/vendor/phpunit/phpunit
names : phpunit/phpunit
support
issues : https://github.com/sebastianbergmann/phpunit/issues
security : https://github.com/sebastianbergmann/phpunit/security/policy
source : https://github.com/sebastianbergmann/phpunit/tree/11.5.55
autoload
files
classmap
src/
requires
ext-dom *
ext-json *
ext-libxml *
ext-mbstring *
ext-xml *
ext-xmlwriter *
myclabs/deep-copy ^1.13.4
phar-io/manifest ^2.0.4
phar-io/version ^3.2.1...
|
33122
|
NULL
|
NULL
|
NULL
|
|
33124
|
1265
|
19
|
2026-05-13T10:05:03.135539+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666703135_m2.jpg...
|
Firefox
|
Usage | Windsurf — Work
|
1
|
windsurf.com/subscription/usage
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Usage | Windsurf
windsurf.com
Platform Sprint 4 Q2 Usage | Windsurf
windsurf.com
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Usage | Windsurf
Usage | Windsurf
Close tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close...
|
[{"role":"AXStaticText","text& [{"role":"AXStaticText","text":"Usage | Windsurf","depth":4,"bounds":{"left":0.08361037,"top":0.68076617,"width":0.03125,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"windsurf.com","depth":4,"bounds":{"left":0.08361037,"top":0.6915403,"width":0.0234375,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Usage | Windsurf","depth":4,"bounds":{"left":0.0,"top":0.6735834,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Usage | Windsurf","depth":5,"bounds":{"left":0.013297873,"top":0.6847566,"width":0.029920213,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.68076617,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.70790106,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
4501606394233386607
|
-180256333557811050
|
visual_change
|
accessibility
|
NULL
|
Usage | Windsurf
windsurf.com
Platform Sprint 4 Q2 Usage | Windsurf
windsurf.com
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Usage | Windsurf
Usage | Windsurf
Close tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
33125
|
1264
|
18
|
2026-05-13T10:05:03.625039+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666703625_m1.jpg...
|
Firefox
|
Usage | Windsurf — Work
|
1
|
windsurf.com/subscription/usage
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-4413010097960033008
|
4926675242682529951
|
click
|
accessibility
|
NULL
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira...
|
33120
|
NULL
|
NULL
|
NULL
|
|
33126
|
1265
|
20
|
2026-05-13T10:05:06.157338+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666706157_m2.jpg...
|
Firefox
|
Usage | Windsurf — Work
|
1
|
windsurf.com/subscription/usage
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Close tab
Platfo Usage | Windsurf
Usage | Windsurf
Close tab
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Usage | Windsurf","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Usage | Windsurf","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.029920213,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.1245012,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6735834,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6847566,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.70790106,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
7347375267774332248
|
-418916315636089722
|
visual_change
|
accessibility
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Close tab
Platfo Usage | Windsurf
Usage | Windsurf
Close tab
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)...
|
33124
|
NULL
|
NULL
|
NULL
|
|
33127
|
1265
|
21
|
2026-05-13T10:05:12.217903+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666712217_m2.jpg...
|
Firefox
|
Usage | Windsurf — Work
|
1
|
windsurf.com/subscription/usage
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Close tab
Platfo Usage | Windsurf
Usage | Windsurf
Close tab
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment
Risk Assessment
CVSS Score:
7.8 (High)
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requirement:
Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.
Resolution and Mitigation
Resolution and Mitigation
Official Patch:
The maintainer updated PHPUnit to treat pre-existing
.coverage
files as an error condition rather than attempting to sanitize and process them.
Recommended Actions:
* Update PHPUnit to the latest patched version in your respective release branch.
Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.
Enforce code reviews and branch protection to prevent malicious file injection.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I fix these vulnareabilities in laravel project
You said
how can I fix these vulnareabilities in laravel project
Listen
Show thinking
Gemini said
Gemini said
Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.
Here is exactly how to secure your project:
1. Check Your Current Version
1. Check Your Current Version
First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:
Bash
Download code
Copy code
composer show phpunit/phpunit
Look at the
versions
line in the output to see if you are running a vulnerable version (anything lower than 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52).
2. Update PHPUnit
2. Update PHPUnit
Tell Composer to update PHPUnit and its associated dependencies to the latest secure versions allowed by your
composer.json
constraints:
Bash
Download code
Copy code
composer update phpunit/phpunit --with-dependencies
Note: If your
composer.json
restricts PHPUnit to an older major version (like
^9.0
), Composer will automatically grab the secure patch for that specific major version (e.g., 9.6.33).
3. Verify the Fix
3. Verify the Fix
Run the
composer show
command from step one again to confirm the version has been bumped. As long as your version is at or above one of the secure releases listed above, you are protected against CVE-2026-24765.
4. Secure Your Environments
4. Secure Your Environments
Because PHPUnit lives in the
require-dev
block of your
composer.json
, this vulnerability does not impact your production environment—
provided you are deploying correctly
.
Always build your production environment using
composer install --no-dev --optimize-autoloader
. This ensures testing frameworks are completely excluded from your live servers.
For your CI/CD pipelines, ensure you are using ephemeral runners (runners that spin up fresh for every job and are destroyed afterward) so that an attacker cannot leave a malicious
.coverage
file behind for a subsequent test run to execute.
Would you like me to walk you through how to verify that your production server is completely free of development dependencies?
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Usage | Windsurf","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Usage | Windsurf","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.029920213,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6735834,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6847566,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.70790106,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"7.8 (High)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requirement:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Resolution and Mitigation","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Resolution and Mitigation","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Official Patch:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The maintainer updated PHPUnit to treat pre-existing","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files as an error condition rather than attempting to sanitize and process them.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Recommended Actions:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"* Update PHPUnit to the latest patched version in your respective release branch.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Enforce code reviews and branch protection to prevent malicious file injection.","depth":28,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I fix these vulnareabilities in laravel project","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I fix these vulnareabilities in laravel project","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly how to secure your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check Your Current Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check Your Current Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer show phpunit/phpunit","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Look at the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"versions","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"line in the output to see if you are running a vulnerable version (anything lower than 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Update PHPUnit","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Update PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tell Composer to update PHPUnit and its associated dependencies to the latest secure versions allowed by your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"constraints:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"composer update phpunit/phpunit --with-dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Note: If your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"restricts PHPUnit to an older major version (like","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"^9.0","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"), Composer will automatically grab the secure patch for that specific major version (e.g., 9.6.33).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Verify the Fix","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Verify the Fix","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer show","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"command from step one again to confirm the version has been bumped. As long as your version is at or above one of the secure releases listed above, you are protected against CVE-2026-24765.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Secure Your Environments","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Secure Your Environments","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because PHPUnit lives in the","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"require-dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"block of your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", this vulnerability does not impact your production environment—","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"provided you are deploying correctly","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Always build your production environment using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"composer install --no-dev --optimize-autoloader","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". This ensures testing frameworks are completely excluded from your live servers.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"For your CI/CD pipelines, ensure you are using ephemeral runners (runners that spin up fresh for every job and are destroyed afterward) so that an attacker cannot leave a malicious","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file behind for a subsequent test run to execute.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Would you like me to walk you through how to verify that your production server is completely free of development dependencies?","depth":24,"bounds":{"left":0.08959442,"top":0.0,"width":0.11502659,"height":0.057861134},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.086269945,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.09690824,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.107546546,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.11818484,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.12882313,"top":0.0,"width":0.010638298,"height":0.025538707},"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.1022274,"top":0.045889866,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
1489474574965396639
|
-2364471354701037946
|
visual_change
|
accessibility
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Close tab
Platfo Usage | Windsurf
Usage | Windsurf
Close tab
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment
Risk Assessment
CVSS Score:
7.8 (High)
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requirement:
Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.
Resolution and Mitigation
Resolution and Mitigation
Official Patch:
The maintainer updated PHPUnit to treat pre-existing
.coverage
files as an error condition rather than attempting to sanitize and process them.
Recommended Actions:
* Update PHPUnit to the latest patched version in your respective release branch.
Implement security best practices in CI/CD, such as using ephemeral runners and strict access controls.
Enforce code reviews and branch protection to prevent malicious file injection.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I fix these vulnareabilities in laravel project
You said
how can I fix these vulnareabilities in laravel project
Listen
Show thinking
Gemini said
Gemini said
Fixing this vulnerability in a Laravel project is a very straightforward process. In Laravel, PHPUnit is managed as a development dependency via Composer, so resolving the issue simply requires updating that package to a patched version.
Here is exactly how to secure your project:
1. Check Your Current Version
1. Check Your Current Version
First, verify which version of PHPUnit your Laravel application is currently using. Run this command in your terminal at the root of your project:
Bash
Download code
Copy code
composer show phpunit/phpunit
Look at the
versions
line in the output to see if you are running a vulnerable version (anything lower than 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52).
2. Update PHPUnit
2. Update PHPUnit
Tell Composer to update PHPUnit and its associated dependencies to the latest secure versions allowed by your
composer.json
constraints:
Bash
Download code
Copy code
composer update phpunit/phpunit --with-dependencies
Note: If your
composer.json
restricts PHPUnit to an older major version (like
^9.0
), Composer will automatically grab the secure patch for that specific major version (e.g., 9.6.33).
3. Verify the Fix
3. Verify the Fix
Run the
composer show
command from step one again to confirm the version has been bumped. As long as your version is at or above one of the secure releases listed above, you are protected against CVE-2026-24765.
4. Secure Your Environments
4. Secure Your Environments
Because PHPUnit lives in the
require-dev
block of your
composer.json
, this vulnerability does not impact your production environment—
provided you are deploying correctly
.
Always build your production environment using
composer install --no-dev --optimize-autoloader
. This ensures testing frameworks are completely excluded from your live servers.
For your CI/CD pipelines, ensure you are using ephemeral runners (runners that spin up fresh for every job and are destroyed afterward) so that an attacker cannot leave a malicious
.coverage
file behind for a subsequent test run to execute.
Would you like me to walk you through how to verify that your production server is completely free of development dependencies?
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
33129
|
1265
|
22
|
2026-05-13T10:05:14.412354+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666714412_m2.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Usage | Windsurf","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Usage | Windsurf","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.029920213,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true}]...
|
9122190711595557623
|
-1997966541319298027
|
click
|
hybrid
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
rirero,•• 0w Usage | WindsurfPlatform Sorint 4 02 - Platform TelDependabot alerts - jiminny/propheJY-19958) Upgrade BE librariesFindings by vulnerability - Vanta13 NVD - cve-2026-33671Low vulnerabilities identitied in oal(*jiminny/app/backend-code - Vanta4. NVD - cve-2026-6724(UY-20773) User Pilot not receivingJY-19957 | Remove abanded symeTypeError: Leaque|Flvsvstem\FileNew TabU Userpilot | Ask Jiminny Report GeS ISRD-68481 Sidekick SMS issue2 (UY-19957) Upgrade BE libraries -• Jy-19957 | Remove abanded svmdHigh vulnerabilities identified in paMedium vulnerabilities identified inLow vulnerabilities identified in na— New TabWindow• = windsurf.com/subscription/usage• Goodle geminiShow thinkingAcsessment. Satebasee on ne ermina ouel vou oroviceevour Laravel prolect is nor vulnerable toCV=-4040-24169.• Your Installed Version: 11.5.55• Secure Patched Version: 11.5.50 (forthe 11.x release branch)Because you are running 11.5.55 , which isnewer than the required security patch, theunsafe deserialization flaw in thecleanupForCoverage() method has alreadybeen resolved in your environment. You don'tneed to take any further action to upgradePHPUnit for this specific CVE.A quick reminder on best practices:Since you are running this inside a Dockercontainer ( docker_1amp_1 ), just ensure thatwhen you build your production containerimages, you continue to use the --no-dev flagwith Composer. This guarantees that PHPUnit isentirely excluded from your live productionenvironments.Enter a prompt for Gemini01 74m 16cAl. It can make mistakes, so double check it. Your privacy & GSummarize pageW WindsurfACCOUNTProfileNotificationsSettingsUsageFEATURESDeploysConversation SharedLog outPRODUCTSvENTERPRISEPRICINGBLOGRESOURCESCOMPANY v‹ S0 liil O l SupportDaily• in 1h 55m A)100% C4 2• Wed 13 May 13:05:13DOWNLOADUsageWindsurf Usage SummaryNext billing cycle is in 2 days on May 15, 2026.Your daily quotaevery day and usage resumes once quota refreshes.Your weekly quotaWeekly quota resets every week and can still limit usage after the daily reset.Extra usage balance availableOnce the quota is reached, Windsurf can continue to be used with free models.lo continue using premium models, purchase extra usage.100.00% remaining|Resets 14 May, 11:00 EEST32.00% remainingResets 17 Mav. 11:00 EESTI$-0.11Purchase usagel...
|
33127
|
NULL
|
NULL
|
NULL
|
|
33130
|
1264
|
20
|
2026-05-13T10:05:17.264949+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666717264_m1.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37...
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Usage | Windsurf","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Usage | Windsurf","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
7529807239883649051
|
-1846513816917133161
|
visual_change
|
accessibility
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta...
|
33128
|
NULL
|
NULL
|
NULL
|
|
33131
|
1265
|
23
|
2026-05-13T10:05:17.723373+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666717723_m2.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment
Risk Assessment
CVSS Score:
7.8 (High)
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requirement:
Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.
Resolution and Mitigation
Resolution and Mitigation
Official Patch:
The maintainer updated PHPUnit to treat pre-existing...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Usage | Windsurf","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Usage | Windsurf","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.029920213,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.09177973,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6735834,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6847566,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.70790106,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Detail","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: N/A","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD assessment","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not yet provided.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CNA: GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Base","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Score: 7.8 HIGH","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Patch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.034408245,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","depth":23,"bounds":{"left":0.1221742,"top":0.0,"width":0.06615692,"height":0.054668795},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.002793296,"width":0.02825798,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Release Notes","depth":23,"bounds":{"left":0.1221742,"top":0.021947326,"width":0.034408245,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","depth":23,"bounds":{"left":0.1221742,"top":0.041101355,"width":0.06632314,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.117717475,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mitigation","depth":23,"bounds":{"left":0.1221742,"top":0.1368715,"width":0.023936171,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.15602554,"width":0.03939495,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","depth":23,"bounds":{"left":0.1221742,"top":0.17517957,"width":0.055352394,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE","depth":23,"bounds":{"left":0.1221742,"top":0.25179568,"width":0.010139627,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Mailing List","depth":23,"bounds":{"left":0.1221742,"top":0.27094972,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Third Party Advisory","depth":23,"bounds":{"left":0.1221742,"top":0.29010376,"width":0.04870346,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"bounds":{"left":0.1221742,"top":0.30925778,"width":0.05618351,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"bounds":{"left":0.1221742,"top":0.32841182,"width":0.019281914,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"bounds":{"left":0.1221742,"top":0.34756583,"width":0.027094414,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"bounds":{"left":0.1221742,"top":0.36671987,"width":0.017121011,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-502","depth":23,"bounds":{"left":0.1221742,"top":0.3858739,"width":0.0234375,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Deserialization of Untrusted Data","depth":23,"bounds":{"left":0.1221742,"top":0.40502793,"width":0.041888297,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub, Inc.","depth":23,"bounds":{"left":0.1221742,"top":0.44333598,"width":0.02825798,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"bounds":{"left":0.1221742,"top":0.46249002,"width":0.061336435,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"bounds":{"left":0.1221742,"top":0.5007981,"width":0.024601065,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5199521,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.5965682,"width":0.06582447,"height":0.073822826},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.67318434,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.7689545,"width":0.06582447,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.86472464,"width":0.06615692,"height":0.09297685},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"bounds":{"left":0.1221742,"top":0.9604948,"width":0.06565824,"height":0.039505184},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"bounds":{"left":0.1221742,"top":1.0,"width":0.046708778,"height":-0.07541895},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3 change records found show changes","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Quick Info","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE Dictionary Entry: CVE-2026-24765 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Published Date: 01/27/2026 NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Last Modified: 03/03/2026","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source: GitHub, Inc.</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-24765: PHPUnit Insecure Deserialization","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVE-2026-24765 describes a high-severity security vulnerability in","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHPUnit","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", a popular testing framework for PHP. The flaw allows for potential","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"through the unsafe handling of code coverage data.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Vulnerability Mechanism","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"cleanupForCoverage()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"method in PHPUnit performs deserialization on","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files during PHPT test execution without restricting the classes that can be instantiated (lacking the","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"allowed_classes","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"parameter).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Attack Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker with local file write access can place a malicious serialized PHP object into a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".coverage","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"__wakeup()","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"magic method, it can trigger arbitrary code execution in the context of the user running the tests.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Affected Versions","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Versions","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The vulnerability impacts versions prior to:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"12.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 12.5.8","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"11.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 11.5.50","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"10.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 10.5.62","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 9.6.33","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Before 8.5.52","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Risk Assessment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"7.8 (High)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requirement:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Resolution and Mitigation","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Resolution and Mitigation","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Official Patch:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The maintainer updated PHPUnit to treat pre-existing","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-3876065802508674354
|
-130615845626757498
|
visual_change
|
accessibility
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765
Detail
Description
PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base
Score: N/A
NVD assessment
not yet provided.
CNA: GitHub, Inc.
Base
Score: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
GitHub, Inc.
Patch
https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
GitHub, Inc.
Release Notes
https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
GitHub, Inc.
Mitigation
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
CVE
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-502
Deserialization of Untrusted Data
GitHub, Inc.
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s)
From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s)
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
3 change records found show changes
Quick Info
CVE Dictionary Entry: CVE-2026-24765 NVD
Published Date: 01/27/2026 NVD
Last Modified: 03/03/2026
Source: GitHub, Inc.</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
Summary of CVE-2026-24765: PHPUnit Insecure Deserialization
CVE-2026-24765 describes a high-severity security vulnerability in
PHPUnit
, a popular testing framework for PHP. The flaw allows for potential
Remote Code Execution (RCE)
through the unsafe handling of code coverage data.
Vulnerability Mechanism
Vulnerability Mechanism
Root Cause:
The
cleanupForCoverage()
method in PHPUnit performs deserialization on
.coverage
files during PHPT test execution without restricting the classes that can be instantiated (lacking the
allowed_classes
parameter).
Attack Vector:
An attacker with local file write access can place a malicious serialized PHP object into a
.coverage
file.
Impact:
When PHPUnit runs tests with code coverage instrumentation enabled, it deserializes the malicious file. If the object contains a
__wakeup()
magic method, it can trigger arbitrary code execution in the context of the user running the tests.
Affected Versions
Affected Versions
The vulnerability impacts versions prior to:
12.x:
Before 12.5.8
11.x:
Before 11.5.50
10.x:
Before 10.5.62
9.x:
Before 9.6.33
8.x:
Before 8.5.52
Risk Assessment
Risk Assessment
CVSS Score:
7.8 (High)
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requirement:
Requires local file write access to the directory where PHPUnit expects coverage files. Common threat environments include compromised CI/CD pipelines, local development machines, or malicious dependencies.
Resolution and Mitigation
Resolution and Mitigation
Official Patch:
The maintainer updated PHPUnit to treat pre-existing...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
33132
|
1265
|
24
|
2026-05-13T10:05:20.751907+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666720751_m2.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Usage | Windsurf","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Usage | Windsurf","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.029920213,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.09177973,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6735834,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6847566,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.70790106,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.1846742,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.1966423,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.1939827,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.08361037,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.16605718,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.17935506,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.079288565,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.079288565,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-153663618176294232
|
-58619548313240442
|
visual_change
|
accessibility
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-24765</tabTitle>” with “<selection>CVE-2026-24765 Detail Description PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. CNA: GitHub, Inc. Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda GitHub, Inc. Patch https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33 GitHub, Inc. Release Notes https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p GitHub, Inc. Mitigation Vendor Advisory https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html CVE Mailing List Third Party Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-502 Deserialization of Untrusted Data GitHub, Inc. Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) Up to (excluding)8.5.52 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)9.0.0Up to (excluding)9.6.33 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)10.0.0Up to (excluding)10.5.62 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)11.0.0Up to (excluding)11.5.50 cpe:2.3:a:phpunit_project:phpunit:*:*:*:*:*:-:*:* Show Matching CPE(s) From (including)12.0.0Up to (excluding)12.5.8 Configuration 2 ( hide ) cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Show Matching CPE(s) Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes Quick Info CVE Dictionary Entry: CVE-2026-24765 NVD Published Date: 01/27/2026 NVD Last Modified: 03/03/2026 Source: GitHub, Inc.</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said...
|
33131
|
NULL
|
NULL
|
NULL
|
|
33133
|
1265
|
25
|
2026-05-13T10:05:23.772183+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666723772_m2.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
jiminny.atlassian.net/jira/software/c/projects/JY/ jiminny.atlassian.net/jira/software/c/projects/JY/boards/37...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
Skip to:
Top Bar
Top Bar
Sidebar
Sidebar
Main Content
Main Content
Space navigation
Space navigation
Collapse sidebar [
Collapse sidebar [
Switch sites or apps
Switch sites or apps
Go to your Jira homepage
lib
lib
Create
Create
Rovo Ask Rovo
Ask Rovo
8 Notifications
8 Notifications
Help
Help
Settings
Settings
[EMAIL]
[EMAIL]
For you
For you
Recent
Recent
Starred
Starred
Apps
Apps
More actions for Apps
More actions for Apps
Spaces
Spaces
Create space
Create space
More actions for spaces
More actions for spaces
Recent
Jiminny (New)
Jiminny (New)
Jiminny (New)
Create board
Create board
More actions for Jiminny (New)
More actions for Jiminny (New)
Platform Team
Platform Team
Board actions
Board actions
Capture Team
Capture Team
Board actions
Board actions
Enterprise Stability Issues 🤕
Enterprise Stability Issues 🤕
Board actions
Board actions
Processing Team
Processing Team
Board actions
Board actions
SE Kanban
SE Kanban
Board actions
Board actions
Service-Desk
Service-Desk
More actions for Service-Desk
More actions for Service-Desk
More spaces
More spaces
Filters
Filters
More actions for Filters
More actions for Filters
Search work items
Search work items
Starred...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Usage | Windsurf","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Usage | Windsurf","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.029920213,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.09177973,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6735834,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6847566,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.70790106,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Skip to:","depth":10,"bounds":{"left":0.090259306,"top":0.07861133,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Top Bar","depth":11,"bounds":{"left":0.090259306,"top":0.097765364,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Top Bar","depth":12,"bounds":{"left":0.090259306,"top":0.097765364,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Sidebar","depth":11,"bounds":{"left":0.090259306,"top":0.11691939,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Sidebar","depth":12,"bounds":{"left":0.090259306,"top":0.11691939,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Main Content","depth":11,"bounds":{"left":0.090259306,"top":0.13607343,"width":0.029421542,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Main Content","depth":12,"bounds":{"left":0.090259306,"top":0.13607343,"width":0.029421542,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Space navigation","depth":11,"bounds":{"left":0.090259306,"top":0.15522745,"width":0.037898935,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Space navigation","depth":12,"bounds":{"left":0.090259306,"top":0.15522745,"width":0.037898935,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Collapse sidebar [","depth":10,"bounds":{"left":0.08361037,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Collapse sidebar [","depth":12,"bounds":{"left":0.0887633,"top":0.06344773,"width":0.039727394,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Switch sites or apps","depth":11,"bounds":{"left":0.095578454,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Switch sites or apps","depth":13,"bounds":{"left":0.10073138,"top":0.06344773,"width":0.044215426,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Go to your Jira homepage","depth":10,"bounds":{"left":0.10887633,"top":0.057861134,"width":0.029421542,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXComboBox","text":"lib","depth":12,"bounds":{"left":0.40475398,"top":0.06264964,"width":0.24268617,"height":0.015961692},"on_screen":true,"value":"lib","help_text":"","placeholder":"Search","role_description":"combo box","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"lib","depth":13,"bounds":{"left":0.40475398,"top":0.06384677,"width":0.0051529254,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Create","depth":11,"bounds":{"left":0.65575135,"top":0.057861134,"width":0.030086435,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Create","depth":13,"bounds":{"left":0.66705453,"top":0.06384677,"width":0.014793883,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Rovo Ask Rovo","depth":13,"bounds":{"left":0.91223407,"top":0.057861134,"width":0.035904255,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Ask Rovo","depth":15,"bounds":{"left":0.92353725,"top":0.06384677,"width":0.020611702,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"8 Notifications","depth":13,"bounds":{"left":0.9494681,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"8 Notifications","depth":15,"bounds":{"left":0.954621,"top":0.06344773,"width":0.031914894,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Help","depth":13,"bounds":{"left":0.96143615,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Help","depth":15,"bounds":{"left":0.9665891,"top":0.06344773,"width":0.010139627,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Settings","depth":13,"bounds":{"left":0.9734042,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Settings","depth":15,"bounds":{"left":0.97855717,"top":0.06344773,"width":0.017952127,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"lukas.kovalik@jiminny.com","depth":13,"bounds":{"left":0.98537236,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"lukas.kovalik@jiminny.com","depth":15,"bounds":{"left":0.99052525,"top":0.06344773,"width":0.009474754,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"For you","depth":13,"bounds":{"left":0.08361037,"top":0.09976058,"width":0.071476065,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"For you","depth":16,"bounds":{"left":0.09424867,"top":0.10574621,"width":0.01662234,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Recent","depth":13,"bounds":{"left":0.08361037,"top":0.12529927,"width":0.071476065,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Recent","depth":16,"bounds":{"left":0.09424867,"top":0.13128492,"width":0.015458777,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Starred","depth":13,"bounds":{"left":0.08361037,"top":0.15083799,"width":0.071476065,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Starred","depth":16,"bounds":{"left":0.09424867,"top":0.15682362,"width":0.016456118,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Apps","depth":13,"bounds":{"left":0.08361037,"top":0.1763767,"width":0.071476065,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Apps","depth":16,"bounds":{"left":0.09424867,"top":0.18236233,"width":0.011635638,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"More actions for Apps","depth":14,"bounds":{"left":0.15309176,"top":0.17956904,"width":0.0039893617,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"More actions for Apps","depth":16,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Spaces","depth":13,"bounds":{"left":0.08361037,"top":0.2019154,"width":0.071476065,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXStaticText","text":"Spaces","depth":16,"bounds":{"left":0.09424867,"top":0.20790103,"width":0.016456118,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Create space","depth":14,"bounds":{"left":0.13646941,"top":0.20510775,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Create space","depth":16,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"More actions for spaces","depth":14,"bounds":{"left":0.14577793,"top":0.20510775,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"More actions for spaces","depth":16,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Recent","depth":17,"bounds":{"left":0.08959442,"top":0.23423783,"width":0.013464096,"height":0.011971269},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Jiminny (New)","depth":18,"bounds":{"left":0.08759973,"top":0.2529928,"width":0.0674867,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Jiminny (New)","depth":21,"bounds":{"left":0.09823803,"top":0.25897846,"width":0.032081116,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Jiminny (New)","depth":19,"bounds":{"left":0.08892952,"top":0.25618514,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXMenuButton","text":"Create board","depth":19,"bounds":{"left":0.13646941,"top":0.25618514,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Create board","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"More actions for Jiminny (New)","depth":19,"bounds":{"left":0.14577793,"top":0.25618514,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"More actions for Jiminny (New)","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Platform Team","depth":20,"bounds":{"left":0.09158909,"top":0.27853152,"width":0.06349734,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Team","depth":23,"bounds":{"left":0.1022274,"top":0.28451717,"width":0.032247342,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Board actions","depth":21,"bounds":{"left":0.15309176,"top":0.28172386,"width":0.0039893617,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Board actions","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Capture Team","depth":20,"bounds":{"left":0.09158909,"top":0.30407023,"width":0.06349734,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Capture Team","depth":23,"bounds":{"left":0.1022274,"top":0.31005585,"width":0.03125,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Board actions","depth":21,"bounds":{"left":0.15309176,"top":0.30726257,"width":0.0039893617,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Board actions","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Enterprise Stability Issues 🤕","depth":20,"bounds":{"left":0.09158909,"top":0.32960895,"width":0.06349734,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Enterprise Stability Issues 🤕","depth":23,"bounds":{"left":0.1022274,"top":0.33559456,"width":0.050531916,"height":0.030726258},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Board actions","depth":21,"bounds":{"left":0.15309176,"top":0.33280128,"width":0.0039893617,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Board actions","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Processing Team","depth":20,"bounds":{"left":0.09158909,"top":0.35514766,"width":0.06349734,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Processing Team","depth":23,"bounds":{"left":0.1022274,"top":0.36113328,"width":0.038231384,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Board actions","depth":21,"bounds":{"left":0.15309176,"top":0.35834,"width":0.0039893617,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Board actions","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"SE Kanban","depth":20,"bounds":{"left":0.09158909,"top":0.38068634,"width":0.06349734,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"SE Kanban","depth":23,"bounds":{"left":0.1022274,"top":0.386672,"width":0.024102394,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Board actions","depth":21,"bounds":{"left":0.15309176,"top":0.38387868,"width":0.0039893617,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Board actions","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Service-Desk","depth":18,"bounds":{"left":0.08759973,"top":0.40622506,"width":0.0674867,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Service-Desk","depth":21,"bounds":{"left":0.09823803,"top":0.4122107,"width":0.03025266,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"More actions for Service-Desk","depth":19,"bounds":{"left":0.15442154,"top":0.4094174,"width":0.0039893617,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"More actions for Service-Desk","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"More spaces","depth":18,"bounds":{"left":0.08759973,"top":0.43176377,"width":0.0674867,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"More spaces","depth":21,"bounds":{"left":0.09823803,"top":0.43774942,"width":0.028756648,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Filters","depth":13,"bounds":{"left":0.08361037,"top":0.45730248,"width":0.071476065,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXStaticText","text":"Filters","depth":16,"bounds":{"left":0.09424867,"top":0.4632881,"width":0.013796543,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"More actions for Filters","depth":14,"bounds":{"left":0.14577793,"top":0.46049482,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"More actions for Filters","depth":16,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Search work items","depth":15,"bounds":{"left":0.08759973,"top":0.4828412,"width":0.0674867,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Search work items","depth":18,"bounds":{"left":0.09823803,"top":0.4888268,"width":0.041223403,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Starred","depth":17,"bounds":{"left":0.08959442,"top":0.5151636,"width":0.014461436,"height":0.011971269},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-7094680416974316348
|
-36278022868453346
|
visual_change
|
accessibility
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
Skip to:
Top Bar
Top Bar
Sidebar
Sidebar
Main Content
Main Content
Space navigation
Space navigation
Collapse sidebar [
Collapse sidebar [
Switch sites or apps
Switch sites or apps
Go to your Jira homepage
lib
lib
Create
Create
Rovo Ask Rovo
Ask Rovo
8 Notifications
8 Notifications
Help
Help
Settings
Settings
[EMAIL]
[EMAIL]
For you
For you
Recent
Recent
Starred
Starred
Apps
Apps
More actions for Apps
More actions for Apps
Spaces
Spaces
Create space
Create space
More actions for spaces
More actions for spaces
Recent
Jiminny (New)
Jiminny (New)
Jiminny (New)
Create board
Create board
More actions for Jiminny (New)
More actions for Jiminny (New)
Platform Team
Platform Team
Board actions
Board actions
Capture Team
Capture Team
Board actions
Board actions
Enterprise Stability Issues 🤕
Enterprise Stability Issues 🤕
Board actions
Board actions
Processing Team
Processing Team
Board actions
Board actions
SE Kanban
SE Kanban
Board actions
Board actions
Service-Desk
Service-Desk
More actions for Service-Desk
More actions for Service-Desk
More spaces
More spaces
Filters
Filters
More actions for Filters
More actions for Filters
Search work items
Search work items
Starred...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
33134
|
1264
|
21
|
2026-05-13T10:05:24.824344+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666724824_m1.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Usage | Windsurf","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Usage | Windsurf","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
-5714148875815029289
|
-2342415137818822505
|
click
|
accessibility
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
33135
|
1265
|
26
|
2026-05-13T10:05:24.801409+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666724801_m2.jpg...
|
Firefox
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira — Work...
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Usage | Windsurf","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Usage | Windsurf","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.029920213,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.09177973,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6735834,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6847566,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.7629689,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
1674404288811614228
|
-180397075341133802
|
click
|
accessibility
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Close tab
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab...
|
33133
|
NULL
|
NULL
|
NULL
|
|
33136
|
1265
|
27
|
2026-05-13T10:05:26.778589+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666726778_m2.jpg...
|
Firefox
|
Work — Mozilla Firefox
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
New Tab
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
22°
C
New York City
Open menu
Mozilla Firefox
Search with Google or enter address
Search with Google or enter address
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Open context menu for Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Open context menu for Pipelines - jiminny/app
Jiminny
Jiminny
Open context menu for Jiminny
Userpilot | Events
Userpilot | Events
Open context menu for Userpilot | Events
Inbox (1,620) - [EMAIL] - Jiminny Mail
Inbox (1,620) - [EMAIL] - Jiminny Mail
Open context menu for Inbox (1,620) - [EMAIL] - Jiminny Mail
Jiminny
Jiminny
Open context menu for Jiminny
JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app
JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app
Open context menu for JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Open context menu for Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Customize
Customize...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Usage | Windsurf","depth":4,"bounds":{"left":0.0,"top":0.074221864,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Usage | Windsurf","depth":5,"bounds":{"left":0.013297873,"top":0.08539505,"width":0.029920213,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.10694334,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.11811652,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.1396648,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.15083799,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.17238627,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.18355946,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.20510775,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.21628092,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.23782921,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.2490024,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.27055067,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.28172386,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.30327216,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.31444532,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.33599362,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.3471668,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.36871508,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.37988827,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.40143654,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.41260973,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.43415803,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.44533122,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.4668795,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.47805268,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.49960095,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.51077414,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.5323224,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5434956,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.56504387,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.57621706,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.5977654,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.6089386,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.63048685,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.64166003,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6632083,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6743815,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.69592977,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.70710295,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.7286512,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.7398244,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.735834,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.7629689,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Bookmarks","depth":5,"bounds":{"left":0.083277926,"top":0.09177973,"width":0.026761968,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bookmarks","depth":6,"bounds":{"left":0.083277926,"top":0.09177973,"width":0.026761968,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close sidebar","depth":6,"bounds":{"left":0.16938165,"top":0.086592175,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXTextField","text":"Search bookmarks","depth":7,"bounds":{"left":0.082446806,"top":0.12210695,"width":0.09857048,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"search text field","subrole":"AXSearchField","is_enabled":true,"is_focused":true,"is_selected":false},{"role":"AXStaticText","text":"22°","depth":8,"bounds":{"left":0.9416556,"top":0.10415004,"width":0.00930851,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"C","depth":8,"bounds":{"left":0.9509641,"top":0.10415004,"width":0.0039893617,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"New York City","depth":8,"bounds":{"left":0.9416556,"top":0.12051077,"width":0.02825798,"height":0.012769354},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Open menu","depth":7,"bounds":{"left":0.97357047,"top":0.0981644,"width":0.01662234,"height":0.043894652},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Mozilla Firefox","depth":8,"bounds":{"left":0.37549868,"top":0.40782124,"width":0.43583778,"height":0.051077414},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXButton","text":"Search with Google or enter address","depth":8,"bounds":{"left":0.4737367,"top":0.4828412,"width":0.2393617,"height":0.0415004},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Search with Google or enter address","depth":10,"bounds":{"left":0.49019283,"top":0.4960096,"width":0.08344415,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":11,"bounds":{"left":0.43384308,"top":0.5482841,"width":0.039893616,"height":0.09736632},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":13,"bounds":{"left":0.43849733,"top":0.61731845,"width":0.030418882,"height":0.06384677},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":11,"bounds":{"left":0.46575797,"top":0.55706304,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Pipelines - jiminny/app","depth":11,"bounds":{"left":0.4737367,"top":0.5482841,"width":0.039893616,"height":0.09736632},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Pipelines - jiminny/app","depth":13,"bounds":{"left":0.4822141,"top":0.61731845,"width":0.022772606,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Pipelines - jiminny/app","depth":11,"bounds":{"left":0.5056516,"top":0.55706304,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Jiminny","depth":11,"bounds":{"left":0.51363033,"top":0.5482841,"width":0.039893616,"height":0.09736632},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Jiminny","depth":13,"bounds":{"left":0.52576464,"top":0.61731845,"width":0.015458777,"height":0.012769354},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Jiminny","depth":11,"bounds":{"left":0.5455452,"top":0.55706304,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Userpilot | Events","depth":11,"bounds":{"left":0.55352396,"top":0.5482841,"width":0.039893616,"height":0.09736632},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Events","depth":13,"bounds":{"left":0.5631649,"top":0.61731845,"width":0.02044548,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Userpilot | Events","depth":11,"bounds":{"left":0.58543885,"top":0.55706304,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Inbox (1,620) - lukas.kovalik@jiminny.com - Jiminny Mail","depth":11,"bounds":{"left":0.5934175,"top":0.5482841,"width":0.039893616,"height":0.09736632},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Inbox (1,620) - lukas.kovalik@jiminny.com - Jiminny Mail","depth":13,"bounds":{"left":0.5980718,"top":0.61731845,"width":0.030418882,"height":0.051077414},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Inbox (1,620) - lukas.kovalik@jiminny.com - Jiminny Mail","depth":11,"bounds":{"left":0.6253325,"top":0.55706304,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Jiminny","depth":11,"bounds":{"left":0.63331115,"top":0.5482841,"width":0.039893616,"height":0.09736632},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Jiminny","depth":13,"bounds":{"left":0.64544547,"top":0.61731845,"width":0.015458777,"height":0.012769354},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Jiminny","depth":11,"bounds":{"left":0.66522604,"top":0.55706304,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app","depth":11,"bounds":{"left":0.6732048,"top":0.5482841,"width":0.039893616,"height":0.09736632},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app","depth":13,"bounds":{"left":0.67852396,"top":0.61731845,"width":0.029089095,"height":0.10215483},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app","depth":11,"bounds":{"left":0.70511967,"top":0.55706304,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":11,"bounds":{"left":0.7130984,"top":0.5482841,"width":0.039893616,"height":0.09736632},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":13,"bounds":{"left":0.71858376,"top":0.61731845,"width":0.028756648,"height":0.08938547},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":11,"bounds":{"left":0.7450133,"top":0.55706304,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Customize","depth":8,"bounds":{"left":0.9797208,"top":0.9509178,"width":0.012965426,"height":0.0311253},"on_screen":true,"help_text":"Customize this page","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Customize","depth":10,"bounds":{"left":0.982879,"top":0.95929766,"width":0.017121017,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
2725773191628694735
|
-4792434925678249833
|
visual_change
|
accessibility
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
New Tab
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
22°
C
New York City
Open menu
Mozilla Firefox
Search with Google or enter address
Search with Google or enter address
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Open context menu for Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Open context menu for Pipelines - jiminny/app
Jiminny
Jiminny
Open context menu for Jiminny
Userpilot | Events
Userpilot | Events
Open context menu for Userpilot | Events
Inbox (1,620) - [EMAIL] - Jiminny Mail
Inbox (1,620) - [EMAIL] - Jiminny Mail
Open context menu for Inbox (1,620) - [EMAIL] - Jiminny Mail
Jiminny
Jiminny
Open context menu for Jiminny
JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app
JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app
Open context menu for JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Open context menu for Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Customize
Customize...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
33137
|
1264
|
22
|
2026-05-13T10:05:28.886166+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666728886_m1.jpg...
|
Firefox
|
Work — Mozilla Firefox
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
New Tab
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
22°
C
New York City
Open menu
Mozilla Firefox
Search with Google or enter address
Search with Google or enter address
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Open context menu for Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Open context menu for Pipelines - jiminny/app
Jiminny
Jiminny
Open context menu for Jiminny
Userpilot | Events
Userpilot | Events
Open context menu for Userpilot | Events
Inbox (1,620) - [EMAIL] - Jiminny Mail
Inbox (1,620) - [EMAIL] - Jiminny Mail
Open context menu for Inbox (1,620) - [EMAIL] - Jiminny Mail
Jiminny
Jiminny
Open context menu for Jiminny
JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app
JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app
Open context menu for JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Open context menu for Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Customize
Customize
jiminny.atlassian.net/jira/servicedesk/projects/SRD/queues/custom/37...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Usage | Windsurf","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Usage | Windsurf","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open Google Gemini (⌃X)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close bookmarks (⌘B)","depth":6,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Bookmarks","depth":5,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bookmarks","depth":6,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close sidebar","depth":6,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXTextField","text":"Search bookmarks","depth":7,"on_screen":true,"help_text":"","role_description":"search text field","subrole":"AXSearchField","is_enabled":true,"is_focused":true,"is_selected":false},{"role":"AXStaticText","text":"22°","depth":8,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"C","depth":8,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"New York City","depth":8,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Open menu","depth":7,"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Mozilla Firefox","depth":8,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXButton","text":"Search with Google or enter address","depth":8,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Search with Google or enter address","depth":10,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":11,"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":13,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":11,"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Pipelines - jiminny/app","depth":11,"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Pipelines - jiminny/app","depth":13,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Pipelines - jiminny/app","depth":11,"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Jiminny","depth":11,"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Jiminny","depth":13,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Jiminny","depth":11,"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Userpilot | Events","depth":11,"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Events","depth":13,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Userpilot | Events","depth":11,"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Inbox (1,620) - lukas.kovalik@jiminny.com - Jiminny Mail","depth":11,"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Inbox (1,620) - lukas.kovalik@jiminny.com - Jiminny Mail","depth":13,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Inbox (1,620) - lukas.kovalik@jiminny.com - Jiminny Mail","depth":11,"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Jiminny","depth":11,"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Jiminny","depth":13,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Jiminny","depth":11,"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app","depth":11,"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app","depth":13,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app","depth":11,"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":11,"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":13,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":11,"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Customize","depth":8,"on_screen":true,"help_text":"Customize this page","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Customize","depth":10,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"jiminny.atlassian.net/jira/servicedesk/projects/SRD/queues/custom/37","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
2451650519274154405
|
-4792434925678249833
|
click
|
accessibility
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
New Tab
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
22°
C
New York City
Open menu
Mozilla Firefox
Search with Google or enter address
Search with Google or enter address
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Open context menu for Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Open context menu for Pipelines - jiminny/app
Jiminny
Jiminny
Open context menu for Jiminny
Userpilot | Events
Userpilot | Events
Open context menu for Userpilot | Events
Inbox (1,620) - [EMAIL] - Jiminny Mail
Inbox (1,620) - [EMAIL] - Jiminny Mail
Open context menu for Inbox (1,620) - [EMAIL] - Jiminny Mail
Jiminny
Jiminny
Open context menu for Jiminny
JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app
JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app
Open context menu for JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Open context menu for Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Customize
Customize
jiminny.atlassian.net/jira/servicedesk/projects/SRD/queues/custom/37...
|
33134
|
NULL
|
NULL
|
NULL
|
|
33138
|
1265
|
28
|
2026-05-13T10:05:28.893796+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666728893_m2.jpg...
|
Firefox
|
Work — Mozilla Firefox
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
New Tab
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
22°
C
New York City
Open menu
Mozilla Firefox
Search with Google or enter address
Search with Google or enter address
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Open context menu for Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Open context menu for Pipelines - jiminny/app
Jiminny
Jiminny
Open context menu for Jiminny
Userpilot | Events
Userpilot | Events
Open context menu for Userpilot | Events
Inbox (1,620) - [EMAIL] - Jiminny Mail
Inbox (1,620) - [EMAIL] - Jiminny Mail
Open context menu for Inbox (1,620) - [EMAIL] - Jiminny Mail
Jiminny
Jiminny
Open context menu for Jiminny
JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app
JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app
Open context menu for JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Open context menu for Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Customize
Customize
jiminny.atlassian.net/jira/servicedesk/projects/SRD/queues/custom/37...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Usage | Windsurf","depth":4,"bounds":{"left":0.0,"top":0.074221864,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Usage | Windsurf","depth":5,"bounds":{"left":0.013297873,"top":0.08539505,"width":0.029920213,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.10694334,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.11811652,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.1396648,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.15083799,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.17238627,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.18355946,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.20510775,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.21628092,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.23782921,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.2490024,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.27055067,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.28172386,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.30327216,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.31444532,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.33599362,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.3471668,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.36871508,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.37988827,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.40143654,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.41260973,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.43415803,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.44533122,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.4668795,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.47805268,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.49960095,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.51077414,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.5323224,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5434956,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.56504387,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.57621706,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.5977654,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.6089386,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.63048685,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.64166003,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6632083,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6743815,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.69592977,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.70710295,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.7286512,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.7398244,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.735834,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.0028257978,"top":0.7629689,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0028257978,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open Google Gemini (⌃X)","depth":6,"bounds":{"left":0.013796543,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.024933511,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.036070477,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close bookmarks (⌘B)","depth":6,"bounds":{"left":0.04720745,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Bookmarks","depth":5,"bounds":{"left":0.083277926,"top":0.09177973,"width":0.026761968,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bookmarks","depth":6,"bounds":{"left":0.083277926,"top":0.09177973,"width":0.026761968,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close sidebar","depth":6,"bounds":{"left":0.16938165,"top":0.086592175,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXTextField","text":"Search bookmarks","depth":7,"bounds":{"left":0.082446806,"top":0.12210695,"width":0.09857048,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"search text field","subrole":"AXSearchField","is_enabled":true,"is_focused":true,"is_selected":false},{"role":"AXStaticText","text":"22°","depth":8,"bounds":{"left":0.9416556,"top":0.10415004,"width":0.00930851,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"C","depth":8,"bounds":{"left":0.9509641,"top":0.10415004,"width":0.0039893617,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"New York City","depth":8,"bounds":{"left":0.9416556,"top":0.12051077,"width":0.02825798,"height":0.012769354},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Open menu","depth":7,"bounds":{"left":0.97357047,"top":0.0981644,"width":0.01662234,"height":0.043894652},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Mozilla Firefox","depth":8,"bounds":{"left":0.37549868,"top":0.40782124,"width":0.43583778,"height":0.051077414},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXButton","text":"Search with Google or enter address","depth":8,"bounds":{"left":0.4737367,"top":0.4828412,"width":0.2393617,"height":0.0415004},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Search with Google or enter address","depth":10,"bounds":{"left":0.49019283,"top":0.4960096,"width":0.08344415,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":11,"bounds":{"left":0.43384308,"top":0.5482841,"width":0.039893616,"height":0.09736632},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":13,"bounds":{"left":0.43849733,"top":0.61731845,"width":0.030418882,"height":0.06384677},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":11,"bounds":{"left":0.46575797,"top":0.55706304,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Pipelines - jiminny/app","depth":11,"bounds":{"left":0.4737367,"top":0.5482841,"width":0.039893616,"height":0.09736632},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Pipelines - jiminny/app","depth":13,"bounds":{"left":0.4822141,"top":0.61731845,"width":0.022772606,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Pipelines - jiminny/app","depth":11,"bounds":{"left":0.5056516,"top":0.55706304,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Jiminny","depth":11,"bounds":{"left":0.51363033,"top":0.5482841,"width":0.039893616,"height":0.09736632},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Jiminny","depth":13,"bounds":{"left":0.52576464,"top":0.61731845,"width":0.015458777,"height":0.012769354},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Jiminny","depth":11,"bounds":{"left":0.5455452,"top":0.55706304,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Userpilot | Events","depth":11,"bounds":{"left":0.55352396,"top":0.5482841,"width":0.039893616,"height":0.09736632},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Events","depth":13,"bounds":{"left":0.5631649,"top":0.61731845,"width":0.02044548,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Userpilot | Events","depth":11,"bounds":{"left":0.58543885,"top":0.55706304,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Inbox (1,620) - lukas.kovalik@jiminny.com - Jiminny Mail","depth":11,"bounds":{"left":0.5934175,"top":0.5482841,"width":0.039893616,"height":0.09736632},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Inbox (1,620) - lukas.kovalik@jiminny.com - Jiminny Mail","depth":13,"bounds":{"left":0.5980718,"top":0.61731845,"width":0.030418882,"height":0.051077414},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Inbox (1,620) - lukas.kovalik@jiminny.com - Jiminny Mail","depth":11,"bounds":{"left":0.6253325,"top":0.55706304,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Jiminny","depth":11,"bounds":{"left":0.63331115,"top":0.5482841,"width":0.039893616,"height":0.09736632},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Jiminny","depth":13,"bounds":{"left":0.64544547,"top":0.61731845,"width":0.015458777,"height":0.012769354},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Jiminny","depth":11,"bounds":{"left":0.66522604,"top":0.55706304,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app","depth":11,"bounds":{"left":0.6732048,"top":0.5482841,"width":0.039893616,"height":0.09736632},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app","depth":13,"bounds":{"left":0.67852396,"top":0.61731845,"width":0.029089095,"height":0.10215483},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app","depth":11,"bounds":{"left":0.70511967,"top":0.55706304,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":11,"bounds":{"left":0.7130984,"top":0.5482841,"width":0.039893616,"height":0.09736632},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":13,"bounds":{"left":0.71858376,"top":0.61731845,"width":0.028756648,"height":0.08938547},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open context menu for Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":11,"bounds":{"left":0.7450133,"top":0.55706304,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"Open menu","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Customize","depth":8,"bounds":{"left":0.9797208,"top":0.9509178,"width":0.012965426,"height":0.0311253},"on_screen":true,"help_text":"Customize this page","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Customize","depth":10,"bounds":{"left":0.982879,"top":0.95929766,"width":0.017121017,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"jiminny.atlassian.net/jira/servicedesk/projects/SRD/queues/custom/37","depth":5,"bounds":{"left":0.18783244,"top":0.9876297,"width":0.120678194,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
2451650519274154405
|
-4792434925678249833
|
click
|
accessibility
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
New Tab
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
22°
C
New York City
Open menu
Mozilla Firefox
Search with Google or enter address
Search with Google or enter address
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Open context menu for Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Open context menu for Pipelines - jiminny/app
Jiminny
Jiminny
Open context menu for Jiminny
Userpilot | Events
Userpilot | Events
Open context menu for Userpilot | Events
Inbox (1,620) - [EMAIL] - Jiminny Mail
Inbox (1,620) - [EMAIL] - Jiminny Mail
Open context menu for Inbox (1,620) - [EMAIL] - Jiminny Mail
Jiminny
Jiminny
Open context menu for Jiminny
JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app
JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app
Open context menu for JY-20543 add AJ reports User pilot tracking by LakyLak · Pull Request #11932 · jiminny/app
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Open context menu for Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Customize
Customize
jiminny.atlassian.net/jira/servicedesk/projects/SRD/queues/custom/37...
|
33136
|
NULL
|
NULL
|
NULL
|
|
33139
|
1265
|
29
|
2026-05-13T10:05:29.815800+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778666729815_m2.jpg...
|
Firefox
|
Jira — Work
|
1
|
jiminny.atlassian.net/jira/servicedesk/projects/SR jiminny.atlassian.net/jira/servicedesk/projects/SRD/queues/custom/37...
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Close tab...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Usage | Windsurf","depth":4,"bounds":{"left":0.0,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Usage | Windsurf","depth":5,"bounds":{"left":0.013297873,"top":0.06304868,"width":0.029920213,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":4,"bounds":{"left":0.0,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.09577015,"width":0.10106383,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Dependabot alerts · jiminny/prophet","depth":4,"bounds":{"left":0.0,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Dependabot alerts · jiminny/prophet","depth":5,"bounds":{"left":0.013297873,"top":0.12849163,"width":0.06216755,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.0,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.16121309,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Findings by vulnerability - Vanta","depth":4,"bounds":{"left":0.0,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Findings by vulnerability - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.19393456,"width":0.055851065,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-33671","depth":4,"bounds":{"left":0.0,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-33671","depth":5,"bounds":{"left":0.013297873,"top":0.22665602,"width":0.041223403,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.25937748,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.0,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.29209897,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.0,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.013297873,"top":0.32482043,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.0,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.3575419,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.39026338,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.0,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.013297873,"top":0.42298484,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.0,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.013297873,"top":0.4557063,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.0,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.013297873,"top":0.4884278,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.0,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.5211492,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.0,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.013297873,"top":0.55387074,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.0,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.013297873,"top":0.5865922,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.61931366,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6408619,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6520351,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.0,"top":0.6735834,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.013297873,"top":0.6847566,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.06732048,"top":0.68076617,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
6621425516496395751
|
-180397075341133802
|
visual_change
|
accessibility
|
NULL
|
Usage | Windsurf
Usage | Windsurf
Platform Sprint Usage | Windsurf
Usage | Windsurf
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Dependabot alerts · jiminny/prophet
Dependabot alerts · jiminny/prophet
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Findings by vulnerability - Vanta
Findings by vulnerability - Vanta
NVD - cve-2026-33671
NVD - cve-2026-33671
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Close tab...
|
NULL
|
NULL
|
NULL
|
NULL
|