---
id: 5094
title: "Impossible XXE in PHP"
source_domain: swarm.ptsecurity.com
source_url: "https://swarm.ptsecurity.com/impossible-xxe-in-php/"
published_at: "2025-03-11T14:49:19Z"
tags: ["php", "web-security", "xxe", "libxml2", "parameter-entities"]
phying_url: "https://phying.com/item/5094"
lang: en
---

# Impossible XXE in PHP

## Summary

PT SWARM shows an 'almost impossible' XXE in PHP is exploitable by defeating four defenses — disabled entity loading, LIBXML_NONET, missing NOENT, a DOM nodeType check — using parameter entities.

## Intelligence Metadata

- **Sources:** swarm.ptsecurity.com
- **Published:** 2025-03-11T14:49:19Z
- **Original:** https://swarm.ptsecurity.com/impossible-xxe-in-php/
- **Phying News:** https://phying.com/item/5094