Skip to content
NativePHP Mobile Security Advisories: Multiple High-Risk Vulnerabilities Disclosed

NativePHP Mobile Security Advisories: Multiple High-Risk Vulnerabilities Disclosed

First seen 27 Oct 2026, 01:26 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 27, 2026 at 09:43 UTC
  • •Seven vulnerabilities disclosed, five rated High (CVSS 7.4-8.1).
  • •Developers must update to nativephp/mobile 4.6.1 or 3.3.11 to mitigate risks.
  • •Two critical PHP vulnerabilities are actively exploited, adding urgency to patching.

NativePHP has released its first set of security advisories for NativePHP for Mobile, addressing seven vulnerabilities, five of which are rated High with CVSS scores ranging from 7.4 to 8.1. The issues primarily stem from unsecured internal API routes that could be exploited if an attacker has JavaScript running in the app's web view. Developers are urged to update to nativephp/mobile version 4.6.1 or 3.3.11 and to rebuild their applications to ensure users receive the patches. Notably, two critical PHP vulnerabilities (CVE-2026-109619 and CVE-2026-109618) were also disclosed recently, with confirmed. The vulnerabilities were reported by independent researchers, but NativePHP criticized the disclosure process for lacking responsible communication. Users remain vulnerable until they install the updated app versions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109619 published
Critical vulnerability with CVSS 9.2 disclosed, first public PoC available.
Laravel-News
2026-10-21
CVE-2026-109618 published
Another critical vulnerability with CVSS 9.2 disclosed, first public PoC available.
Laravel-News
2026-10-26
CVE-2026-109619 added to CISA KEV
CISA added this vulnerability to its KEV catalog due to active exploitation.
Laravel-News
2026-10-26
NativePHP advisories published
NativePHP released its first security advisories, addressing seven vulnerabilities in mobile apps.
nativephp.com

More articles in this cluster (6)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3

Common questions

What versions of NativePHP are affected?
Versions 1.x and 2.x are end-of-life and will not receive patches; users should upgrade to 4.6.1 or 3.3.11.
How urgent is it to apply the updates?
It is critical to apply the updates immediately due to active exploitation of related vulnerabilities.
What steps should developers take to secure their apps?
Developers should update to the latest versions, rebuild their apps, and submit new builds to app stores.