CVE-2016-9935: The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows rem...

Security readout for executives and security teams

Older PHP releases can mishandle a malformed WDDX XML packet containing an empty boolean element. If an exposed application parses attacker-controlled WDDX data, a remote attacker may crash the PHP process or trigger memory corruption. The public bundle does not show confirmed active exploitation. Exposure is most likely in legacy PHP applications or services that have WDDX enabled and parse WDDX XML from users, integrations, queues, or APIs. Systems not using WDDX parsing are less likely to be reachable through this bug. Address during legacy PHP remediation, sooner if internet-facing systems parse WDDX input. The main documented risk is service disruption, with memory corruption raising uncertainty. Lack of active exploitation evidence lowers emergency urgency, but unsupported PHP increases business risk. Mitigation focus: Upgrade PHP to 5.6.29, 7.0.14, or a supported fixed release.; Check OS vendor advisories for backported PHP security fixes.; Disable or remove WDDX support where it is not required..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.