PHP 5.3.9 along with any older versions for which the hash collision DoS patch was backported, are affected, Eiram said.