Regular expression functions in the mbstring component were found to have vulnerabilities that could lead to a complete system compromise through crafted multibyte sequences.
If your system reports 5.6.4.0 (rare), that would be an from ~2014. It contains hundreds of known vulnerabilities, including critical remote code execution bugs. Do not use it anywhere. php version 5640 vulnerabilities link