CVE-2015-1351: Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache exte...

Security readout for executives and security teams

CVE-2015-1351 is an old PHP OPcache memory-safety flaw. Public CVE text says remote attackers could cause a denial of service, with possible unspecified other impact, through unknown vectors. Treat it as relevant mainly for legacy PHP estates still running PHP through 5.6.7 or vendor packages that never received 2015-era fixes. Exposure is most likely on legacy servers running PHP through 5.6.7 with OPcache present, especially unmanaged or end-of-life web stacks. Modern supported PHP versions should not be assumed exposed from these sources alone, but inventory should confirm actual package versions and vendor backports. Prioritize remediation where legacy PHP handles public traffic or critical business workflows. This is not KEV-backed in the provided sources, but remote denial of service against unsupported PHP can still create business outage risk. Mitigation focus: Identify PHP runtimes and packages that include OPcache.; Apply vendor PHP security updates covering CVE-2015-1351.; Prioritize internet-facing legacy PHP servers..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.