From a security scoring perspective, the cumulative vulnerabilities in PHP versions below 5.6.40 are severe. The CVSS v3 base score for the aggregated vulnerabilities, as reported by Tenable, is with the vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H . This score indicates:

(These categories reflect vulnerabilities verified by security researchers against end-of-life PHP 5.6 releases; specific CVE identifiers exist in public advisories for many items.) php version 5640 vulnerabilities verified