Stray PHPUnit Test Files Keep Exposing Production Servers
The risky assumption is that an old CVE is low priority because it is old. In this case, the real exposure is not the framework version alone but public test artifacts like eval-stdin.php left on live web servers, which still give attackers a code execution path years after disclosure.
VulnCheck says it saw more than 80,000 exploitation attempts in 30 days and 36,500 in the last 10 days, with scanning getting more sophisticated. The issue affects PHPUnit versions before 4.8.28 and 5.x before 5.6.3, and the vulnerable file is eval-stdin.php in the PHPUnit test tree.
Patch level alone does not close the door if that file is still reachable on the web. The lasting risk is inherited development debris in production, which keeps a once-public test helper in active attack range.