Hazard

Is CVE-2020-28949 being exploited?

Weaponised and widely attempted

Reliable public exploit code exists, or mass exploitation attempts are probable. Patch inside days, not weeks.

PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability

PEAR · Archive_Tar

CVSS 7.8 EPSS 85% no public exploit indexed Fix deadline passed 15 September 2022

What it is

PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.

Why we say that

  • EPSS puts exploitation in the next 30 days at 85%
  • CISA's federal remediation deadline (2022-09-15) has passed
  • Listed in the CISA Known Exploited Vulnerabilities catalogue

Every line above comes from a named public source. Where the evidence is thin, we say so rather than inventing confidence — see methodology.

What to do

Apply updates per vendor instructions.

What it costs when this goes wrong

This is where UK enforcement meets the vulnerability record. Where an unfixed vulnerability leads to a breach, the ICO treats it as a security failure under UK GDPR. Recent cases:

All UK cases caused by unpatched software →