Zero Radar
← feed
CriticalVulnerabilityCVE-2026-62016updated 29 Oct 2026, 20:19 UTC

Gamic: unauthenticated attackers can inject malicious PHP objects

Someone on the internet with no login can send specially crafted data to the Gamic website software and potentially make it run code the attacker chose. This can let them take over the site.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends crafted dataNo login needed from the internet
  2. 2Gamic unsafely unserializes inputUntrusted data is turned into PHP objects
  3. 3Malicious object triggers codeGadget code runs on the server
  4. 4Attacker gains controlServer and data can be taken over
  5. ResultAttacker controls the server

What happened

Gamic versions 1.19 and earlier contain an unauthenticated PHP Object Injection flaw, where untrusted input is unsafely deserialized.

Why it is dangerous: An attacker needs no account, so any internet-facing Gamic site could be compromised, exposing data and server control.

Are you affected?

You are affected if you run Gamic version 1.19 or earlier on a publicly reachable server.

Gamic <= 1.19

What to do

  1. Check which Gamic version you run and confirm whether it is 1.19 or earlier.
  2. Check the official Gamic site or the GitHub advisory for a fixed release and update as soon as one is available.
  3. Until patched, restrict access to the site or disable it if possible, and review logs for unusual requests.

Timeline

  1. 29 Oct 2026, 16:18 UTC
    Publicly disclosed
  2. 29 Oct 2026, 16:18 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 16:20 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 20:19 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-62016 · GHSA-v35g-pjfq-8qfw
CVSS
9.8 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
29 Oct 2026, 16:18 UTC
On Zero Radar
29 Oct 2026, 16:20 UTC (2 min after disclosure)
Last change
29 Oct 2026, 20:19 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Gamic: unauthenticated attackers can inject malicious PHP objects · Zero Radar