CVE-2015-6834: PHP unserialization use-after-free enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCritical CVSS (9.8) with network, unauthenticated reachability and high EPSS, though no confirmed in-the-wild exploitation is recorded.

What it is

PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 contain multiple use-after-free flaws in the Serializable interface, SplObjectStorage, and SplDoublyLinkedList classes that are mishandled during unserialization. Because these are memory-corruption bugs reachable from untrusted serialized input, they matter for any application that unserializes attacker-controlled data.

Impact

An attacker can corrupt memory and execute arbitrary code in the context of the PHP process, giving full control over the affected service and its data.

Attack surface

The vector is network-reachable with no privileges or user interaction required (CVSS AV:N/AC:L/PR:N/UI:N), so exploitation is possible wherever an application passes attacker-supplied data to unserialize().

Exploitation

The record is not listed in CISA KEV and carries no exploit-tagged references, but EPSS is high at 0.468 (98.8th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade PHP to 5.4.45, 5.5.29, 5.6.13 or later, or apply the vendor/distribution patches (Debian DSA-3358, Gentoo GLSA 201606-10).
• Eliminate unserialize() on untrusted input; use JSON or another non-executable format for data exchange.
• Where unserialize() is unavoidable, enforce strict allowed_classes and validate input before deserialization.
• Run PHP services with least privilege and isolate them so code execution does not grant broad host access.

Detection

• Search application code and logs for unserialize() calls that accept request, cookie, or file-derived data.
• Monitor PHP processes for unexpected child processes, outbound connections, or file writes that suggest post-exploitation.
• Alert on crashes or abnormal memory behavior in PHP-FPM/Apache workers handling serialized input.
• Inventory PHP versions across hosts and flag any instance below the fixed releases.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.