CVE-2016-7478: Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to...

Security readout for executives and security teams

This is a PHP denial-of-service issue. A remote attacker may be able to make a vulnerable PHP process loop indefinitely if an application processes crafted serialized Exception objects. The main business risk is service disruption, not data theft, based on the supplied sources. Exposure is most likely where internet-facing PHP applications deserialize attacker-controlled or user-influenced data. Organizations still running unsupported PHP 5.x or early PHP 7.x should treat exposure as plausible until inventoried. Prioritize legacy PHP inventory and upgrades where public services or vendor appliances process user input. This is not evidenced as actively exploited, but unsupported PHP exposure can turn a DoS flaw into a recurring availability risk. Mitigation focus: Inventory PHP versions across web servers, containers, appliances, and embedded runtimes.; Upgrade off PHP versions listed as affected; confirm current vendor guidance.; Remove or constrain deserialization of untrusted PHP serialized objects..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.