Which versions of PHP are affected by CVE-2026-40044?

Pachno 1.0.6 contains a critical remote code execution vulnerability in its deserialization mechanism that allows unauthenticated attackers to execute arbitrary code by manipulating world-writable…

How to fix or mitigate CVE-2026-40044?

Within 24 hours: inventory all systems running Pachno 1.0.6 and assess internet exposure; immediately restrict network access to affected Pachno instances using firewall rules. Within 7 days: contact Pachno vendor for patch timeline and interim security updates; implement application-level input validation and disable automatic deserialization if configuration options exist. Within 30 days: upgrade to patched Pachno version when released by vendor; audit cache directory permissions to remove world-writable access; conduct forensic review of logs for exploitation attempts.

PHP CVE-2026-40044

Q: What is the CVSS score of CVE-2026-40044?

CVE-2026-40044 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-22053 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-04-13 VulnCheck

PHP Deserialization RCE

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:37 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 12:33 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

EUVD ID Assigned

Apr 13, 2026 - 18:56 euvd

EUVD-2026-22053

Analysis Generated

Apr 13, 2026 - 18:56 vuln.today

CVE Published

Apr 13, 2026 - 18:11 nvd

CRITICAL 9.3

DescriptionCVE.org

Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malicious serialized objects into cache files. Attackers can write PHP object payloads to world-writable cache files with predictable names in the cache directory, which are unserialized during framework bootstrap before authentication checks occur.

AnalysisAI

Remote code execution in Pachno 1.0.6 allows unauthenticated attackers to achieve arbitrary code execution by exploiting unsafe deserialization of PHP objects. Attackers write malicious serialized payloads to world-writable cache files with predictable names, which are automatically unserialized during framework bootstrap before authentication occurs. EPSS indicates 0.14% probability of exploitation (33rd percentile), no active exploitation confirmed per CISA KEV, and SSVC classifies this as automatable with total technical impact.

Technical ContextAI

Pachno is a PHP-based project management and collaboration platform. This vulnerability stems from CWE-502 (Deserialization of Untrusted Data), a critical weakness where applications unserialize data from untrusted sources without validation. PHP's unserialize() function is particularly dangerous because it can instantiate arbitrary objects and trigger magic methods (__wakeup, __destruct, __toString) during deserialization, enabling gadget chain attacks. The affected product (cpe:2.3:a:pancho:pachno:*:*:*:*:*:*:*:*) implements a file-based caching mechanism that stores serialized PHP objects in a predictable directory structure. The cache files are world-writable and processed during the framework's bootstrap sequence-critically, before any authentication middleware executes. This design flaw creates a pre-authentication remote code execution vector where attackers control both the file contents and trigger automatic deserialization through normal application requests.

RemediationAI

Upgrade Pachno to a patched version beyond 1.0.6 immediately-consult the official Pachno project repository and security advisories at https://www.vulncheck.com/advisories/pachno-filecache-deserialization-remote-code-execution for exact fixed release numbers. As an immediate mitigation, restrict filesystem permissions on the cache directory to prevent world-writable access (chmod 750 or equivalent, with web server user as owner), though this is not a complete fix as authenticated users or local processes may still exploit the deserialization flaw. Review web server and PHP-FPM configurations to ensure proper file permission defaults. Consider implementing web application firewall (WAF) rules to block requests containing PHP serialization signatures (O: patterns) in parameters or POST bodies, though determined attackers may bypass filters. For production environments, isolate Pachno instances behind VPN or IP allowlisting until patching is completed. Monitor application logs for unusual cache file creation patterns or PHP errors related to object instantiation.