PHP 5.6 and PHP2Shell: is it vulnerable, what fixes it, and how to prove you fixed it
PHP says nothing about 5.x, but both vulnerable paths are in vanilla 5.6.40: zend_mm_safe_error() ends in zend_bailout(), and session.upload_progress.enabled defaults to 1. The fix is sury patch 0261, and the half it deliberately left out arrived the next day in revision 5.6.40-105 as patch 0263.