PACKAGIST · AUGUST 2026 · EARLY WARNING

Phalcon Volt Compiler Vulnerability: Critical CVE-2026-59989 Alert

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
Affected component: phalcon/volt (packagist)
Patched version: Not yet available

GHSA-HRWP-4HH9-C8R8

An early warning has been issued for a critical vulnerability in the Phalcon Volt compiler, which could lead to remote code execution. Applications using Phalcon/Volt are reportedly at risk.

What happened

The Volt template compiler in Phalcon is under investigation for a critical vulnerability. It appears to generate PHP code for the `join` filter by concatenating raw template-literal argument bytes without proper escaping. This could allow remote code execution if an attacker can control the Volt source. The vulnerability affects any application that compiles attacker-controlled Volt templates.

The vulnerability, tracked as CVE-2026-59989 and GHSA-HRWP-4HH9-C8R8, was first flagged on August 21, 2026. It is classified as a critical CVE with high severity. There is no evidence yet of exploitation in the wild, and it is not currently considered a supply-chain attack.

What to do about it

Check if your application uses Phalcon/Volt and review your dependencies.
Upgrade to a patched version of Phalcon/Volt if one is available. No authoritative version range has been published yet.
Sanitize all user inputs used in Volt templates to prevent potential code injection.
Monitor the primary sources for updates on the vulnerability and any available patches.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If phalcon/volt is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If your application uses Phalcon/Volt, you may be affected. Check your dependencies and review the primary sources for more information.

What should I do right now?

Review your use of Phalcon/Volt, upgrade to a patched version if available, sanitize user inputs, and monitor the primary sources for updates.

Is there an official fix available?

No official fix has been published yet. Monitor the primary sources for updates on any available patches.

Sources

[GHSA-hrwp-4hh9-c8r8] Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)

Join the 0Day waitlist →

← Back to all threats