--- title: When static analysis runs your code | daily.dev description: A security vulnerability (CVE-2026-65954, CVSS 8.6) in PHPCSUtils was discovered where the `AbstractArrayDeclarationSniff` class passed source code from files... canonical: https://daily.dev/posts/when-static-analysis-runs-your-code-pueryt53u twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: When static analysis runs your code | daily.dev og:description: A security vulnerability (CVE-2026-65954, CVSS 8.6) in PHPCSUtils was discovered where the `AbstractArrayDeclarationSniff` class passed source code from files... og:url: https://daily.dev/posts/when-static-analysis-runs-your-code-pueryt53u og:image: https://api.daily.dev/og/posts/pUERYT53u.png og:image:alt: When static analysis runs your code og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # When static analysis runs your code **[PHPUnit Expert](https://daily.dev/sources/phpunit-expert)** · 8 min read · 1 upvotes · 0 comments ## Summary A security vulnerability (CVE-2026-65954, CVSS 8.6) in PHPCSUtils was discovered where the `AbstractArrayDeclarationSniff` class passed source code from files under analysis directly to `eval()`, allowing arbitrary code execution during static analysis. The author explores why PHP's `disable_functions` cannot block `eval()` (it's a language construct, not a function, compiled to the `ZEND_INCLUDE_OR_EVAL` opcode), then proposes and implements a new `zend.disable_eval` INI setting in a PHP 8.6 development build. The patch adds a runtime check in the opcode handler, making it compatible with JIT and leaving C-level APIs (used by `php -r`, `php -a`, debuggers) unaffected. A related PHP-Parser vulnerability (versions 5.6.0–5.7.0) where the pipe operator `|>` caused dynamic function calls during constant expression evaluation is also discussed, illustrating that `eval()` is not the only way static analysis tools can inadvertently execute code. The author argues for `zend.disable_eval` as an opt-in hardening mechanism for code-analysis services, noting it would need to go through PHP's RFC process. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What was the PHPCSUtils eval() vulnerability CVE-2026-65954 and which versions are affected? PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contained a high-severity vulnerability (CVE-2026-65954, CVSS 8.6, GHSA-r6hr-vr92-vv28) in the AbstractArrayDeclarationSniff class's getActualArrayKey() method, which passed source code from the file under analysis to eval(). An array key written as a function call, such as 'system'('id'), would execute rather than merely be read. The issue is fixed in version 1.2.3. _daily.dev surfaces disclosures like this so teams patch static analysis tooling before untrusted code runs in CI._ ### Why can't PHP's disable_functions setting disable eval()? disable_functions cannot block eval() because eval() is not a function but a language construct, compiled by PHP into the ZEND_INCLUDE_OR_EVAL opcode (the same one used by include and require). disable_functions works by removing entries from the global function table, and eval() has no such entry, making it structurally unreachable by that mechanism. _developers hardening PHP deployments track engine-level nuances like this through daily.dev._ ### What does the proposed zend.disable_eval PHP setting do and what still works when it's enabled? zend.disable_eval is a proposed PHP INI setting (patched experimentally in a PHP 8.6 development build) that throws a catchable Error whenever userland eval() executes at runtime, while leaving php -r, the php -a interactive shell, and phpdbg's ev command working since they use a separate compile-string API. It is ZEND_INI_SYSTEM scoped, so ini_set() cannot toggle it at runtime, and it does not block include, FFI, or process-execution functions. _daily.dev helps developers evaluating PHP hardening options follow proposals like zend.disable_eval as they progress._ ## Similar posts on daily.dev - [Clarify security policy of disable\_functions](https://daily.dev/posts/clarify-security-policy-of-disable-functions-2vlqxcjhw) · externals.io · 0 upvotes · 0 comments - [Introducing Reachability for PHP](https://daily.dev/posts/introducing-reachability-for-php-ihrgyb73d) · Socket · 33 upvotes · 0 comments - [CVE-2026-48805: Sandbox state regression in deprecated internal wrappers in \`src/Resources/core.php\` \(Symfony Blog\)](https://daily.dev/posts/cve-2026-48805-sandbox-state-regression-in-deprecated-internal-wrappers-in-src-resources-core-php--jtqmbfedh) · Symfony · 0 upvotes · 0 comments - [\[RFC\] Pure-code source files via the .phpc extension](https://daily.dev/posts/rfc-pure-code-source-files-via-the-phpc-extension-vab1etgtt) · externals.io · 0 upvotes · 0 comments - [CVE-2026-46626: SymfonyRuntime CVE-2024-50340 Patch Bypass via parse\_str/SAPI Argv Mismatch \(Symfony Blog\)](https://daily.dev/posts/cve-2026-46626-symfonyruntime-cve-2024-50340-patch-bypass-via-parse-str-sapi-argv-mismatch-symfony-9izegafmu) · Symfony · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php) [View this post on daily.dev](https://daily.dev/posts/when-static-analysis-runs-your-code-pueryt53u) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"When static analysis runs your code","url":"https://daily.dev/posts/when-static-analysis-runs-your-code-pueryt53u","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/when-static-analysis-runs-your-code-pueryt53u"},"datePublished":"2026-07-29T04:22:29.104Z","dateModified":"2026-09-14T06:40:27.672Z","description":"A security vulnerability (CVE-2026-65954, CVSS 8.6) in PHPCSUtils was discovered where the `AbstractArrayDeclarationSniff` class passed source code from files...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c8dd96b80fdd58325ce0b3919c10ea57?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c8dd96b80fdd58325ce0b3919c10ea57?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"PHPUnit Expert","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"PHPUnit Expert","logo":"https://media.daily.dev/image/upload/s--FMZoysoG--/f_auto,q_auto/v1774964057/logos/phpunit-expert?_a=BAMAMiWQ0","url":"https://daily.dev/sources/phpunit-expert"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/when-static-analysis-runs-your-code-pueryt53u","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"PHPUnit Expert","item":"https://daily.dev/sources/phpunit-expert"},{"@type":"ListItem","position":3,"name":"When static analysis runs your code"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/when-static-analysis-runs-your-code-pueryt53u#faq","mainEntity":[{"@type":"Question","name":"What was the PHPCSUtils eval() vulnerability CVE-2026-65954 and which versions are affected?","acceptedAnswer":{"@type":"Answer","text":"PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contained a high-severity vulnerability (CVE-2026-65954, CVSS 8.6, GHSA-r6hr-vr92-vv28) in the AbstractArrayDeclarationSniff class's getActualArrayKey() method, which passed source code from the file under analysis to eval(). An array key written as a function call, such as 'system'('id'), would execute rather than merely be read. The issue is fixed in version 1.2.3. daily.dev surfaces disclosures like this so teams patch static analysis tooling before untrusted code runs in CI."}},{"@type":"Question","name":"Why can't PHP's disable_functions setting disable eval()?","acceptedAnswer":{"@type":"Answer","text":"disable_functions cannot block eval() because eval() is not a function but a language construct, compiled by PHP into the ZEND_INCLUDE_OR_EVAL opcode (the same one used by include and require). disable_functions works by removing entries from the global function table, and eval() has no such entry, making it structurally unreachable by that mechanism. developers hardening PHP deployments track engine-level nuances like this through daily.dev."}},{"@type":"Question","name":"What does the proposed zend.disable_eval PHP setting do and what still works when it's enabled?","acceptedAnswer":{"@type":"Answer","text":"zend.disable_eval is a proposed PHP INI setting (patched experimentally in a PHP 8.6 development build) that throws a catchable Error whenever userland eval() executes at runtime, while leaving php -r, the php -a interactive shell, and phpdbg's ev command working since they use a separate compile-string API. It is ZEND_INI_SYSTEM scoped, so ini_set() cannot toggle it at runtime, and it does not block include, FFI, or process-execution functions. daily.dev helps developers evaluating PHP hardening options follow proposals like zend.disable_eval as they progress."}}]} ```