package

Packagist/phalcon/cphalcon

pkg:packagist/phalcon/cphalcon

HIGHPackagist

Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

Modified: 8/28/2026

CRITICALPackagist

Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)

Modified: 9/11/2026

HIGHPackagist

Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS

Modified: 8/28/2026