PHP Unsupported Version Detection

Tenable plugin 58987 is not a CVE and does not prove exploitability by itself. It reports that the detected PHP runtime is on an unsupported branch, meaning upstream no longer ships security fixes for that line. As of 2026-06-01 per PHP's official lifecycle, 8.1 and older are end-of-life, while 8.2, 8.3, 8.4, and 8.5 remain supported; Tenable's own plugin text says only that the remote host contains an unsupported version of PHP.

The vendor's Critical/10.0 label does not match operational reality. Unsupported software is dangerous because future and already-known flaws stop getting fixed, but this plugin does not identify a concrete remotely exploitable weakness, a reachable attack surface, or active exploitation on its own. Treat it as a fleet risk amplifier and upgrade driver, not as a midnight-zero-day.

Why this verdict

• Start at 10.0, then subtract hard: Tenable's baseline assumes worst-case impact from unsupported software, but there is no named bug, no exploit chain, and no proof of reachability in this plugin.
• Requires a second failure: An attacker still needs a real PHP, framework, or application vulnerability that affects the detected branch and is reachable in the deployment.
• Exposure is uneven in the real world: Internet-facing PHP tiers deserve attention, but internal-only apps, reverse-proxied stacks, and hidden version banners reduce reachable population and immediate exploitability.

Why not higher?

There is no CVE, no EPSS, no KEV entry, and no direct in-the-wild signal for the finding itself. Operationally, you cannot justify a Critical queue jump on a version-state detection that still needs a second bug and the right runtime conditions.

Why not lower?

Unsupported PHP on public web infrastructure is not harmless backlog dust. PHP is ubiquitous, attackers can enumerate it at scale, and once a branch is EOL you are betting your estate that no future branch-specific bug or app-layer exploit lands before you upgrade.

1. Prioritize internet-facing PHP first — Split findings into public-facing, partner-exposed, and internal-only buckets, then work the exposed tiers first. For a MEDIUM noisgate verdict there is no mitigation SLA; use this triage immediately while moving directly toward the 365-day remediation window.
2. Constrain legacy PHP behind reverse controls — Put unsupported apps behind a hardened reverse proxy or WAF policy that blocks direct access to admin paths, odd query encodings, and known exploit patterns. There is no mitigation SLA for MEDIUM, so do this where it is cheap and high-yield rather than pretending every legacy host is an emergency.
3. Kill version disclosure — Remove X-Powered-By, disable public info pages, and normalize error responses so branch identification is harder. This does not fix the risk, but it adds friction to commodity scanning while you use the 365-day remediation window to migrate.
4. Reduce web-tier privilege — Run PHP workers with least privilege, isolate secrets, and lock down outbound network paths so a future PHP or app exploit has less payoff. Again, no mitigation SLA here; apply these as risk-reduction measures while scheduling actual upgrades.

Run this on the target host or through your config-management/EDR remote shell on any server that has a local PHP binary. Invoke it as python3 check_php_eol.py /usr/bin/php on Linux/macOS or py check_php_eol.py "C:\php\php.exe" on Windows; no admin rights are required if the PHP binary is executable by the current user.

#!/usr/bin/env python3
# check_php_eol.py
# Determine whether a locally installed PHP runtime is on an upstream-supported branch.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import datetime
import os
import re
import shutil
import subprocess
import sys

SUPPORT_END = {
    '5.0': '2005-09-05',
    '5.1': '2006-08-24',
    '5.2': '2011-01-06',
    '5.3': '2014-08-14',
    '5.4': '2015-09-03',
    '5.5': '2016-07-21',
    '5.6': '2018-12-31',
    '7.0': '2019-01-10',
    '7.1': '2019-12-01',
    '7.2': '2020-11-30',
    '7.3': '2021-12-06',
    '7.4': '2022-11-28',
    '8.0': '2023-11-26',
    '8.1': '2025-12-31',
    '8.2': '2026-12-31',
    '8.3': '2027-12-31',
    '8.4': '2028-12-31',
    '8.5': '2029-12-31',
}

VERSION_RE = re.compile(r'PHP\s+(\d+)\.(\d+)\.(\d+)', re.IGNORECASE)


def fail_unknown(msg):
    print(f'UNKNOWN - {msg}')
    sys.exit(2)


def run_php(path):
    try:
        cp = subprocess.run([path, '-v'], capture_output=True, text=True, timeout=10)
    except FileNotFoundError:
        fail_unknown(f'PHP binary not found: {path}')
    except Exception as e:
        fail_unknown(f'Failed to execute PHP: {e}')

    output = (cp.stdout or '') + '\n' + (cp.stderr or '')
    if cp.returncode not in (0,):
        fail_unknown(f'php -v returned {cp.returncode}: {output.strip()}')
    return output


def parse_version(text):
    m = VERSION_RE.search(text)
    if not m:
        fail_unknown('Could not parse PHP version from php -v output')
    major, minor, patch = m.groups()
    full = f'{major}.{minor}.{patch}'
    branch = f'{major}.{minor}'
    return full, branch


def main():
    php_path = None

    if len(sys.argv) > 1:
        php_path = sys.argv[1]
    else:
        php_path = shutil.which('php')

    if not php_path:
        fail_unknown('No PHP path supplied and php was not found in PATH')

    if not os.path.exists(php_path):
        fail_unknown(f'Path does not exist: {php_path}')

    output = run_php(php_path)
    full, branch = parse_version(output)

    if branch not in SUPPORT_END:
        fail_unknown(f'Unsupported or unknown branch map for detected version {full}; update this script')

    today = datetime.date.today()
    support_end = datetime.date.fromisoformat(SUPPORT_END[branch])

    if today > support_end:
        print(f'VULNERABLE - PHP {full} is on EOL branch {branch}; upstream support ended {support_end.isoformat()}')
        sys.exit(1)
    else:
        print(f'PATCHED - PHP {full} is on supported branch {branch}; upstream support ends {support_end.isoformat()}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Tenable Nessus Plugin 58987
2. PHP Supported Versions
3. PHP Unsupported Branches
4. PHP Release Process RFC
5. PHP 8 Changelog
6. Censys Advisory for CVE-2024-4577
7. W3Techs PHP Usage Statistics
8. CISA Known Exploited Vulnerabilities Catalog