KEV: PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
NVD: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Hunt web access logs for POST requests to /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php - any hit on an exposed path is hostile; stock combined logs omit the '<?php ' body, so flag oversized POSTs or add WAF request-body capture.
Research details
Componentsrc/Util/PHP/eval-stdin.php - eval('?>'.file_get_contents('php://input')) on the raw POST body
PreconditionsA Composer install of PHPUnit before 4.8.28 or 5.x before 5.6.3 must sit under a web server docroot that exposes the vendor directory, i.e. http(s)://host/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php must be reachable over the network - a docroot/permissions misconfiguration (classic exposed Laravel/Symfony/Zend dev deploys), not a default-reachable endpoint; the file itself is not part of any runtime application surface. The endpoint is unauthenticated, so a single HTTP POST whose body begins with '<?php ' executes arbitrary PHP as the web server user. agent
DeliveryHTTP POST to an exposed /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php endpoint with a request body starting '<?php ' containing arbitrary PHP; typically delivered by mass scanning of PHP deployments with web-accessible vendor directories.
Exploit notesCVSS attack complexity: LOW; CRITICAL severity (9.8). eval-stdin.php passes the unauthenticated raw POST body straight to eval(), so exploitation is one HTTP request: POST data starting '<?php ' (public tools use wrappers like <?php echo '[S]'; echo(shell_exec('cmd')); echo '[E]'; ?> and parse the delimiters out of the response). A decade after disclosure it remains among the most mass-scanned RCEs (VulnCheck 2026 telemetry); fixed in PHPUnit 4.8.28 and 5.6.3.
SummaryCVE-2017-9841 is unauthenticated remote code execution through PHPUnit's src/Util/PHP/eval-stdin.php, which evaluates the raw POST body via eval(); any request beginning '<?php ' sent to an internet-reachable /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php runs as the web server user. Exploitation requires a vulnerable Composer-installed PHPUnit (before 4.8.28 / 5.6.3) behind a web server that exposes the vendor directory - a recurring misconfiguration on PHP framework deployments. Fixed in PHPUnit 4.8.28 and 5.6.3; still heavily mass-scanned nearly a decade later.
Tia coverage
First reported2026-09-11
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.