CVE-2015-8878: main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety,...

Security readout for executives and security teams

Older PHP 5.5 and 5.6 releases had a thread-safety flaw in temporary-file handling. A remote attacker could potentially crash affected applications by causing many temporary-file accesses, creating denial-of-service risk rather than confirmed data theft. Exposure is most likely in web-facing applications running PHP before 5.5.28 or PHP 5.6.x before 5.6.12, especially where application workflows create many temporary files. Treat this as a targeted availability risk for legacy PHP estates. Prioritize remediation where affected PHP versions support customer-facing or business-critical applications. Mitigation focus: Upgrade PHP to 5.5.28, 5.6.12, or a later fixed release where applicable.; Check current PHP vendor or distribution guidance for supported remediation paths.; Prioritize internet-facing applications that perform heavy temporary-file operations..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.