PHP version 5.6.40 was the final security release for the PHP 5.6 branch. While its release in early 2019 fixed several critical issues, it is now officially and has not received official security patches since late 2018. Critical Vulnerabilities Fixed in 5.6.40
A flaw in the xmlrpc_decode function that can lead to information disclosure or crashes. php version 5640 vulnerabilities link