CVE-2007-1583: The mb_parse_str function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 sets the internal register_glo...

Security readout for executives and security teams

This is an old PHP flaw that can make applications behave as if register_globals is enabled, even when scripts cannot detect it. That can let attacker-supplied input influence variables in legacy PHP applications. Business risk is mainly in forgotten, internet-facing systems still running affected PHP versions. Exposure is most likely in legacy PHP 4.x or early PHP 5.x deployments using mbstring and mb_parse_str. Publicly reachable applications are the concern, especially code written assuming register_globals is off. Modern PHP deployments are not indicated as affected in the provided bundle. Treat this as a legacy exposure cleanup item. It is not KEV-listed, but any affected internet-facing PHP stack is far past support expectations and may carry broader accumulated risk beyond this single CVE. Mitigation focus: Identify and retire PHP 4.x and early PHP 5.x runtimes.; Apply vendor PHP security updates referenced by your operating system vendor.; Upgrade beyond PHP 4.4.6 or 5.2.1 where applicable..

Prepared

Jun 29, 2026, 06:37 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.