CVE-2015-8866: ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate eac...

Security readout for executives and security teams

This flaw affects older PHP deployments using PHP-FPM. A request that supplies XML could interfere with libxml entity-loader state across requests, allowing XXE or entity-expansion impact. Business risk depends on whether internet-facing applications parse untrusted XML on affected PHP versions. Likely exposure is legacy PHP-FPM services running the affected PHP versions and accepting XML input through web routes, APIs, uploads, SOAP, SAML, or XML-based integrations. Treat this as a legacy exposure cleanup item with higher priority for internet-facing XML workflows. It is not KEV-listed in the supplied data, but XXE can affect confidentiality and availability when reachable. Mitigation focus: Upgrade PHP to a fixed or currently supported vendor package.; Prioritize internet-facing PHP-FPM applications that parse untrusted XML.; Review Ubuntu, Red Hat, SUSE, and PHP advisories for package-specific fixes..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.