PHP 5.6.21 is running on 418 websites worldwide, but it harbors a dangerous secret: eight critical vulnerabilities that can be exploited by attackers to crash your site, steal data, or take complete control. These aren't minor bugs—they're critical security flaws that demand immediate attention. If your website runs this outdated version, you're sitting on a ticking time bomb.
The vulnerabilities span multiple PHP extensions including bcmath, XML parsing, internationalization features, and EXIF processing. Each one can allow remote attackers to cause denial of service attacks, execute arbitrary code, or access sensitive data. The concerning part? Many website owners don't even know their sites are vulnerable.
This guide will help you identify if you're affected, understand the risks, and implement the fixes before cybercriminals exploit these weaknesses.
PHP 5.6.21 is an older version of PHP, the programming language that powers over 77% of all websites on the internet. Think of PHP as the engine that makes your website work—it processes user requests, manages your database, and generates the pages visitors see. PHP 5.6.21 was released in 2016 and reached end-of-life in December 2018, meaning it no longer receives security updates or support from developers.
When a PHP version becomes outdated, it's like leaving your front door unlocked while you're away. Attackers know exactly which security holes exist in old versions and actively exploit them. The 8 critical vulnerabilities in PHP 5.6.21 are well-documented, which makes them even more attractive targets for hackers. Websites using this version face increased risks of data breaches, service disruptions, and malware infections that can harm both their business and their visitors.
8 CVEs found. The most critical are explained below.
A mathematical calculation function in PHP can be abused by sending it invalid numbers, causing your website to crash or malfunction. An attacker could do this remotely without needing any special access to your server.
Impact: Your website could become unavailable (downtime), affecting customers' ability to access your services and potentially damaging your reputation.
↗ View on NVDAnother issue with the math function where it corrupts internal system memory when processing certain calculations. This can cause unexpected behavior or system crashes on your server.
Impact: Your website could crash, become unstable, or potentially allow attackers to execute malicious code on your server.
↗ View on NVDPHP's XML processing function has a flaw that crashes when it receives specially crafted malicious XML data. Any website accepting XML input (like APIs or data uploads) is vulnerable.
Impact: Your website could crash or become unavailable when processing certain data, disrupting service for legitimate users.
↗ View on NVDA text searching function can crash when given specific invalid input parameters. This affects any functionality on your site that searches for text or characters.
Impact: Your website could crash or malfunction when users attempt text searches or related features, degrading user experience.
↗ View on NVDSimilar to CVE-2016-4540, another text search function crashes with specific invalid input, potentially affecting search and text processing features.
Impact: Your website could become unstable or crash when processing text searches, causing service interruptions.
↗ View on NVDPHP's image file processing function crashes when handling specially crafted image files with corrupted metadata. This affects any site that accepts image uploads.
Impact: Attackers could crash your website by uploading malicious image files, or potentially gain unauthorized server access.
↗ View on NVDShowing first 10 of 2. View all on NVD ↗
| CVE ID | Severity | Score | Published | Description |
|---|---|---|---|---|
| CVE-2016-4543 | CRITICAL | 9.8 | 2016-05-22 | The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers… |
| CVE-2016-4544 | CRITICAL | 9.8 | 2016-05-22 | The exif_process_TIFF_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate TIFF start data, which allows remote at… |
Plain English · Fix recommendations · Instant PDF & HTML download
Scan your site in 30 seconds. Used by 500+ web agencies.
Running PHP 5.6.21 puts your website at serious risk. The 8 critical vulnerabilities in this outdated version are actively exploited by cybercriminals targeting websites that haven't been updated. The good news is that upgrading is straightforward and can be done quickly with your hosting provider's help. Don't wait until you experience a breach—take action today to protect your business, your data, and your visitors.
Using SiteRecipe.com's vulnerability scanner, you can continuously monitor your website for outdated software, known CVEs, and security misconfigurations. Our platform automatically alerts you when vulnerabilities like these PHP issues are discovered on your domain, so you're never caught off guard. Start your free security audit now and get peace of mind knowing your website is protected against known threats.
Web agencies use SiteRecipe to produce branded PDF security reports in 30 seconds.