CVE-2015-8867: The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28...

Security readout for executives and security teams

CVE-2015-8867 is a PHP cryptographic randomness issue. Older PHP versions used a weaker OpenSSL function inside openssl_random_pseudo_bytes, potentially weakening protections such as tokens or other secrets generated by applications. The public record does not provide CVSS scoring, confirmed exploitation, or detailed attack vectors. Exposure is likely limited to systems running affected PHP versions where application code uses openssl_random_pseudo_bytes for security-sensitive randomness, such as tokens, nonces, or keys. Supported operating-system packages may have separate backported fixes from vendor advisories. Treat this as a conditional cryptographic risk. It is most important for legacy PHP systems that generate security tokens or secrets. Prioritize remediation during legacy PHP review or internet-facing application maintenance. Mitigation focus: Upgrade PHP to versions fixed by the applicable PHP or distribution advisory.; Apply relevant Ubuntu, Red Hat, or SUSE security updates where PHP is vendor-packaged.; Prioritize systems generating authentication tokens, reset links, nonces, or cryptographic secrets in PHP..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.