CVE-2006-1032: Eval injection vulnerability in the decode function in rpc_decoder.php for phpRPC 0.7 and earlier, as used...

Security readout for executives and security teams

CVE-2006-1032 is a remote code execution issue in phpRPC 0.7 and earlier. If an exposed application embeds this old library, an attacker may be able to make the server run arbitrary PHP code. The source data names runcms and exoops as users, with other programs possible but not confirmed. Exposure is most likely in legacy PHP sites that bundled phpRPC 0.7 or earlier, especially runcms, exoops, or other applications carrying rpc_decoder.php. Modern environments are affected only if this legacy code remains deployed or reachable. Prioritize if any legacy PHP application is internet-facing. The business risk is server compromise, but urgency depends on whether phpRPC is actually present and reachable. The source bundle lacks evidence of current exploitation. Mitigation focus: Inventory PHP applications for phpRPC 0.7 or earlier and rpc_decoder.php.; Check vendor or project guidance before choosing a replacement or patch path.; Remove, upgrade, or disable components that depend on vulnerable phpRPC..

Prepared

Jun 29, 2026, 14:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.