CVE-2016-1902: The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x b...

Security readout for executives and security teams

Symfony had a weakness in a fallback random-number generator used for cryptographic protections. It mattered only under specific conditions: affected Symfony versions running on PHP 5.x, without random_compat, when OpenSSL random generation failed. Weak randomness can undermine tokens, secrets, or other protections that depend on unpredictability. Exposure is most likely in legacy PHP 5.x applications using affected Symfony versions and SecureRandom for security-sensitive tokens or secrets. Current Symfony and modern PHP environments are less likely exposed, but inventories should confirm versions and runtime conditions. Treat this as a legacy-platform risk, not a broad emergency. Prioritize systems that still run PHP 5.x with old Symfony and generate authentication, reset, or cryptographic tokens. Absence of active exploitation evidence lowers urgency, but weak randomness can create serious security failure modes. Mitigation focus: Upgrade Symfony to 2.3.37, 2.6.13, 2.7.9, or later supported releases.; Install vendor-provided Debian fixes where Symfony was supplied by Debian packages.; For PHP 5.x systems, confirm random_compat is present and usable..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.