Staying on 5.6.40 is often referred to as "leaving your front door unlocked".
If you are auditing a server or writing a risk assessment report, you need the hard data. Below are the primary sources for PHP vulnerability information.
Improper memory operations in PHAR reading functions could allow an attacker to disclose sensitive information by persuading a user to parse a crafted filename.