CVE-2002-0253: PHP, when not configured with the "display_errors = Off" setting in php.ini, allows remote attackers to obt...

Security readout for executives and security teams

This is a legacy PHP information-disclosure issue. If production PHP shows detailed errors to users, some malformed requests can make an include fail and reveal the server’s physical file path. That path exposure does not grant access by itself, but it can help attackers map the application for later attacks. Exposure is most likely in old or misconfigured PHP applications where production error display is enabled and directly accessible scripts use include files. The supplied sources do not identify specific affected PHP versions or products. Treat as low urgency unless legacy PHP systems expose production errors. The business concern is reconnaissance value: leaked paths can make later attacks easier. Prioritize quick configuration verification on internet-facing PHP services. Mitigation focus: Set display_errors = Off for production PHP environments.; Send detailed PHP errors to protected server-side logs.; Review directly accessible PHP scripts that depend on include files..

Prepared

Jul 1, 2026, 07:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.