CVE-2015-8935: The sapi_header_op function in main/SAPI.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6....

Security readout for executives and security teams

This is an old PHP header-handling flaw that could let an attacker trigger cross-site scripting in Internet Explorer when an application passes unsafe input into HTTP headers. Business risk is mainly for legacy PHP estates or unsupported systems still serving IE-compatible clients. Exposure is most likely on legacy PHP 5.4, 5.5, or early 5.6 deployments, especially applications that build headers from request-controlled values. Modern supported PHP deployments should not be affected by the described version ranges. Treat this as a legacy-platform cleanup item unless affected PHP versions are internet-facing or business-critical. Prioritize remediation where unsupported PHP remains deployed, because the same systems likely carry broader accumulated security risk. Mitigation focus: Upgrade affected PHP versions to the fixed release or a supported PHP branch.; Apply relevant operating-system vendor PHP security updates.; Review header() usage that includes request-controlled values..

Prepared

Jun 13, 2026, 14:00 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.