Forkward

PHP 5.6, end of life since 31 December 2018

PHP 5.6.40 vulnerabilities

PHP 5.6.40 is the last PHP 5.6 release. The US National Vulnerability Database lists 18 vulnerabilities for this version, 4 of them critical. One of them is on the CISA catalogue of known exploited vulnerabilities: CVE-2026-109619. Support for PHP 5.6 ended on 31 December 2018: flaws found since then get no official fix for it.

  • 18known vulnerabilities
  • 4critical
  • 9high
  • 1exploited in the wild

Actively exploited since 26 October 2026

PHP 5.6.40 is affected by PHP2Shell.

CVE-2026-109619 lets an attacker run code on your server without logging in. PHP fixed it only in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. We backport the fix to PHP 5.6.40 within 48 hours of your order, or within 24 hours with priority delivery.

Read about PHP2Shell

What you can do

Keep PHP 5.6.40, patched

We backport the security fixes to the version you run. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.

Upgrade

Move to a supported PHP release, if your applications can make the jump. The fixes keep you safe while you plan it.

Assess first

Our assessment shows which of these vulnerabilities are real on your servers, what else is outdated, and the remediation plan.

Request a server assessment

All 18 known vulnerabilities in PHP 5.6.40

US National Vulnerability Database, 28 October 2026, highest score first. Scores are CVSS 3 where NVD has one and CVSS 2 for older entries, which has no Critical level. Exploited: listed in the CISA catalogue of known exploited vulnerabilities. Distribution builds may already include vendor fixes for some of them.
CVEScoreSeverityPublishedDescription
CVE-2017-89239.8Critical2017-05-12The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.
CVE-2017-92259.8Critical2017-05-24An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds write in onigenc_unicode_get_case_fold_codes_by_str() occurs during regular expression compilation. Code point 0xFFFFFFFF is not properly handled in unicode_unfold_key(). A malformed regular expression could result in 4 bytes being written off the end of a stack buffer of expand_case_fold_string() during the call to onigenc_unicode_get_case_fold_codes_by_str(), a typical stack buffer overflow.
CVE-2019-96419.8Critical2019-03-09An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF.
CVE-2024-35669.8Critical2024-04-10A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
CVE-2026-109619 Exploited8.1High2026-10-21PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
CVE-2017-79637.5High2017-04-19The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings. NOTE: the vendor disputes this, stating "There is no security issue here, because GMP safely aborts in case of an OOM condition. The only attack vector here is denial of service. However, if you allow attacker-controlled, unbounded allocations you have a DoS vector regardless of GMP's OOM behavior.
CVE-2017-92297.5High2017-05-24An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition.
CVE-2018-193957.5High2018-11-20ext/standard/var.c in PHP 5.x through 7.1.24 on Windows allows attackers to cause a denial of service (NULL pointer dereference and application crash) because com and com_safearray_proxy return NULL in com_properties_get in ext/com_dotnet/com_handlers.c, as demonstrated by a serialize call on COM("WScript.Shell").
CVE-2018-193967.5High2018-11-20ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unserialize call for the com, dotnet, or variant class.
CVE-2019-96377.5High2019-03-09An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data.
CVE-2019-96387.5High2019-03-09An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the maker_note->offset relationship to value_len.
CVE-2019-96397.5High2019-03-09An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len variable.
CVE-2017-72727.4High2017-03-27PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.
CVE-2015-92536.5Medium2018-02-19An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.
CVE-2022-316296.5Medium2022-09-28In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
CVE-2022-49006.2Medium2023-11-02A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.
CVE-2007-32055.0Medium2007-06-13The parse_str function in (1) PHP, (2) Hardened-PHP, and (3) Suhosin, when called without a second parameter, might allow remote attackers to overwrite arbitrary variables by specifying variable names and values in the string to be parsed. NOTE: it is not clear whether this is a design limitation of the function or a bug in PHP, although it is likely to be regarded as a bug in Hardened-PHP and Suhosin.
CVE-2022-316282.3Low2022-09-28In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.