CVE-2007-1582: The resource system in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows context-dependent attackers t...

Security readout for executives and security teams

Older PHP 4 and early PHP 5 releases had a resource-handling flaw that could let a context-dependent attacker run arbitrary code. The issue involves interrupting certain extension functions through a userspace error handler, affecting GD and possibly other extensions. Evidence in the bundle does not confirm active exploitation. Exposure is likely limited to legacy applications still running the listed PHP versions, especially where GD or affected extensions are enabled and userspace error handlers are used. The provided affected-product metadata is incomplete, so validation must rely on runtime inventory. Prioritize remediation if any internet-facing or business-critical system still runs the affected PHP versions. The vulnerability is old, but arbitrary code execution plus public exploit references make legacy exposure unacceptable. Mitigation focus: Inventory and prioritize hosts running PHP 4.0.0-4.4.6 or 5.0.0-5.2.1.; Check PHP or distribution vendor guidance for fixed upgrade targets.; Remove or isolate affected PHP runtimes where immediate upgrade is not possible..

Prepared

Jun 29, 2026, 06:37 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.