CVE-2015-8865

PHP’s Fileinfo feature looks at files to figure out what type they are. This bug can be triggered by a “crafted magic file” so that PHP mishandles memory and crashes the process. In rarer cases, it may allow something more serious than a crash, but the most immediate, practical risk for a small business is downtime and service disruption.

This matters if you run PHP on a server or service where the Fileinfo component is used to inspect files (for example, any workflow that processes uploaded files or determines file type). The risk is highest when an attacker can influence what PHP processes so they can feed a specially crafted input into the fileinfo flow. If attackers cannot reach that processing path (for example, they have no practical way to supply the crafted file contents), exposure is less likely.

This should be treated as a meaningful update, because a vulnerable PHP version can be forced to crash, and crafted inputs can potentially go further than a denial of service. There’s no public exploit code on record for this issue, and it is not listed in CISA’s KEV catalog, but press attention is rising—so you should upgrade on your next available maintenance window with priority.