CVE-2002-0953: globals.php in PHP Address before 0.2f, with the PHP allow_url_fopen and register_globals variables enabled...

Security readout for executives and security teams

CVE-2002-0953 is an old remote code execution issue in PHP Address before 0.2f. If the application runs with risky PHP settings enabled, an external attacker may cause the server to run attacker-supplied PHP code. This is mainly a legacy exposure concern. Exposure is likely limited to legacy PHP Address installations before 0.2f that still run with allow_url_fopen and register_globals enabled. Organizations with old PHP applications, archived intranet tools, or unmanaged web roots should verify whether PHP Address is present. Treat this as high priority if PHP Address is present, because the impact is server-side code execution. If asset inventory confirms no PHP Address or no legacy PHP configuration, residual urgency drops substantially. Mitigation focus: Inventory web servers for PHP Address, especially versions before 0.2f.; Remove PHP Address if it is no longer business-required.; If retained, move off versions before 0.2f and check vendor guidance..

Prepared

Jun 30, 2026, 11:55 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.