CVE-2026-27206: The Zumba Class Dance: RCE via PHP Object Injection in json

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-27206: RCE Vulnerability in Zumba Json Serializer Affects PHP Applications CVE-2026-27206 identifies a vulnerability in the Zumba Json Serializer library, affecting versions 3.2.2 and below. The library's deserialization feature allows attackers to instantiate arbitrary PHP classes via untrusted JSON input, leading to potential remote code execution (RCE). Applications utilizing this library are at risk if they process attacker-controlled JSON data. 2 sources 48