CVE-2015-4147: The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x befor...

Security readout for executives and security teams

This is an old PHP SOAP vulnerability that can let an attacker run code if a vulnerable application accepts crafted serialized data that reaches SoapClient. The main business risk is legacy PHP exposure in applications or vendor platforms that still run unpatched PHP 5.4, 5.5, or 5.6 builds. Exposure is most likely in legacy PHP systems using ext/soap and unsafe unserialize handling. The CVE names PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7. Distribution advisories indicate downstream package impact across multiple vendors. Treat as a legacy-platform cleanup priority with high impact where reachable. It is not listed as KEV in the provided bundle, but arbitrary code execution in PHP can become business-critical if exposed through unsafe application input handling. Mitigation focus: Upgrade PHP to a fixed release or vendor-patched package.; Prioritize systems running PHP 5.4, 5.5, or 5.6 with ext/soap enabled.; Remove or tightly restrict unserialize on untrusted input..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.