CVE-2026-37552

Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke TCP server (Server.php:87) receives data from a TCP socket, passes it directly to Opis\Closure\unserialize(), then executes the result via call_user_func(). No authentication or signature verification exists on the TCP connection. An attacker with access to the localhost TCP port (server binds 127.0.0.1) can send a crafted serialized PHP closure to achieve arbitrary code execution.

• CWE-502

• https://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975Third Party Advisory
• https://github.com/mix-php/mixProduct
• https://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.phpProduct

Published

May 1, 2026

Last Modified

Jul 8, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-37538Buffer overflow vulnerability in socketcand 0.4.2 in file so…7.5
• CVE-2026-37539Buffer overflow vulnerability in cannelloni v2.0.0 in CAN fr…9.8
• CVE-2026-3754A vulnerability was found in SourceCodester Sales and Invent…8.8
• CVE-2026-37540OpenAMP v2025.10.0 ELF loader contains an integer overflow v…9.8
• CVE-2026-37541Buffer overflow vulnerability in Open Vehicle Monitoring Sys…10
• CVE-2026-3755A vulnerability was determined in SourceCodester Sales and I…8.8
• CVE-2026-37554An issue was discovered in Vanetza V2X v26.02 allowing remot…7.5
• CVE-2026-37555An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec.…7.5
• CVE-2026-3756A vulnerability was identified in SourceCodester Sales and I…8.8
• CVE-2026-3757A security flaw has been discovered in projectworlds Online …9.8
• CVE-2026-37579An issue in SMSGate sms-core<=2.1.13.6 allows a remote attac…7.3
• CVE-2026-3758A weakness has been identified in projectworlds Online Art G…9.8