CVE-2016-7480: The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not ver...

Security readout for executives and security teams

CVE-2016-7480 is a PHP 7 flaw in SplObjectStorage deserialization. If an application accepts crafted serialized data from an attacker, PHP may allow code execution or crash. The business risk is highest for internet-facing PHP apps that deserialize untrusted input. Exposure is likely where PHP before 7.0.12 runs applications that call unserialize or otherwise process attacker-controlled serialized data involving SplObjectStorage. Systems using packaged PHP inside appliances or storage products should also be checked against vendor advisories. Prioritize remediation for externally reachable PHP applications and products with unsafe deserialization paths. The issue can enable code execution, but urgency depends on whether attacker-supplied serialized data reaches vulnerable PHP before 7.0.12. Mitigation focus: Inventory PHP runtimes and flag any PHP 7.0 versions earlier than 7.0.12.; Upgrade affected PHP runtimes to PHP 7.0.12 or later per vendor guidance.; Review applications for unserialize use on user-controlled or external data..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.