NativePHP has published its first security advisories, seven of them at once, for NativePHP for Mobile. All seven are fixed in nativephp/mobile 4.6.1 and 3.3.11, and in version 1.0.3 of the nativephp/mobile-file plugin. Five are rated High, with CVSS scores from 7.4 to 8.1.
In the same post, the team covered how it handled this week's critical PHP security releases. NativePHP apps bundle their own copy of PHP. To get the patched PHP to your users, you need to rebuild your app and release a new version.
What You Should Do
A package update alone does not protect your users. They get the fixes when they install a new release of your app.
- Update
nativephp/mobileto 4.6.1. Apps on the 3.x line can use 3.3.11. - On 4.x, uninstall the
nativephp/mobile-fileplugin. The core package has its ownFile.MoveandFile.Copy, and the plugin's versions can override the patched ones. On 3.x, update the plugin to 1.0.3. - Run
php artisan native:install --forceto regenerate the native project, then rebuild. - Submit the new build to the App Store and Google Play. Your users are still vulnerable until they install the update.
Versions 1.x and 2.x of nativephp/mobile are end-of-life and will not get patches. The team recommends upgrading to v4.
The Seven Advisories
Most of the issues come from the internal /_native/api/* routes that the web view uses to talk to the native side. Those routes had no middleware, and some bridge functions accepted their input without checks. Most of the attacks only work if an attacker already has JavaScript running in your app's web view, for example through an XSS bug or a compromised third-party script. Most of the CVSS scores list the attack complexity as high.
| Advisory | Severity | Issue | Fixed in |
|---|---|---|---|
| GHSA-9884-fw9c-mq85 | High (8.1) | Web view pages could call the async task bridge and inject PHP code through a non-UUID task ID | 4.6.1 |
| GHSA-83jv-8h7x-287p | High (7.7) | /_native/api/events instantiated any autoloadable class named in the request |
3.3.11, 4.6.1 |
| GHSA-3w4w-cchh-qvrw | High (7.7) | File.Move and File.Copy accepted any absolute path in the app sandbox |
4.6.1 |
| GHSA-7927-vv5p-fv4f | High (7.7) | The same unrestricted paths in the mobile-file plugin |
1.0.3 |
| GHSA-9g37-88p8-75j2 | High (7.4) | Async task files were passed to unserialize() without authentication |
4.6.1 |
| GHSA-76px-r497-93p9 | Moderate (5.9) | Path traversal in the /_assets handler could read files outside public/, including the SQLite database |
3.3.11, 4.6.1 |
| GHSA-27jx-7m9x-fx5c | Moderate (4.1) | Android release builds wrote the Laravel session cookie and XSRF token to logcat | 3.3.11, 4.6.1 |
Two of the fixes can change how your app behaves:
- Events dispatched through
/_native/api/eventsmust now implementNative\Mobile\Events\Contracts\DispatchableFromNative. If you maintain a plugin that dispatches its own events through that endpoint, add the interface to those event classes. - Async task payloads are now encrypted and authenticated with your app key. Apps without an app key can no longer dispatch async tasks. Apps that don't use async tasks were never affected by this issue.
How the Issues Were Reported
aragossa reported the logcat issue privately. acd421 found the other six, and RedEye Security passed the findings on to NativePHP.
Those six were not reported privately. They were published with working exploit chains after RedEye posted its write-up. The researcher's disclosure says they were reported through Tidelift, but NativePHP says it has not received any notice from Tidelift. From the post:
We advocate for responsible disclosure. That means giving maintainers a private heads-up and a reasonable window to fix things before details and exploit code go public, so that the people who build on our tools, and their users, aren't left exposed in the meantime. This wasn't that.
The team asks researchers to report issues in any NativePHP package by email to the address in its security policy, or through the "Report a vulnerability" button on a repository's Security tab.
Patched PHP Binaries
The PHP releases on October 21 fixed CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. Volker Dusch of the PHP Foundation explained how those were found and disclosed in our interview with him. The fixed releases that affect NativePHP are PHP 8.5.12, 8.4.27, and 8.3.36.
NativePHP has rebuilt every PHP binary it distributes on those releases and removed the vulnerable builds from distribution. The binaries now ship with published hashes and signatures, and the tooling checks them on download. That check is in nativephp/desktop 2.4.0 and nativephp/mobile 3.3.11, and the team says it will come to nativephp/mobile 4.7.0 in the coming days.
To get the patched PHP into your app, update, run php artisan native:install --force, then rebuild and ship. These are the same steps as the mobile fixes above.
Desktop 2.4.0 also no longer needs the nativephp/php-bin package, which is now deprecated. After you upgrade, you can remove it:
composer remove nativephp/php-binThe full details, including a timeline of the week, are in NativePHP's post, Our first security advisories, and this week's PHP CVEs.
