Skip to content

Product

intercom/intercom-php vulnerabilities

2 published CVES affecting intercom/intercom-php, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
1
High
0
Medium
0
Low
0
Unscored
1
CISA KEV
0

Latest intercom/intercom-php CVEs

Newest publication first

  1. MAL-2026-3637 Malicious code in intercom-php (Packagist)

    Published
    Unknown

    -= Per source details. Do not edit below this line.=- Source: google-open-source-security (0bd33abd6fda35e856f8346fda5e85913ce2cad6b4d6c315a2e7138b867760aa) This package is malicious and was compromised as part of the Mini Shai-Hulud campaign by the TeamPCP threat actor. The mali...

  2. GHSA-gr3r-crp5-qrrm Compromised tag of intercom-php published via GitHub

    Published
    CriticalCVSS 9.3

    Impact On April 30, 2026, a malicious commit was pushed to the intercom/intercom-php repository and tagged as version 5.0.2, using a compromised service account (github-management-service). This occurred as part of the same supply chain attack that affected intercom-client on npm...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.