PHP Foundation Admits Structural Failures Delayed Critical Security Fix for Two Years

The PHP Foundation has admitted that internal decision-making problems and insufficient resources delayed the resolution of a serious security vulnerability in PHP, one of the programming languages widely used to power websites and online services. In a statement published on October 21, 2026, the organisation described the delay as a structural failure after releasing emergency updates addressing two critical vulnerabilities that could allow attackers to execute malicious code on affected servers without authentication. The foundation explained that developers first identified signs of one of the underlying problems in 2024 but struggled to agree on a solution that would not break existing applications or introduce additional security risks. The admission has raised questions about how vulnerabilities affecting widely used internet infrastructure are managed, particularly when the software depends on a relatively small group of developers and volunteers.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, affect fundamental areas of PHP’s memory management and error-handling systems. According to the PHP Foundation, one flaw could cause memory corruption when a server reaches a particular memory limit, potentially allowing an unauthenticated attacker to execute code under certain configurations. The second vulnerability involves outdated internal state and memory that may already have been released, potentially creating another route to remote code execution. Because these mechanisms are involved in handling ordinary requests, the problems could affect a broad range of applications running vulnerable versions of PHP. Security researchers warned that successful exploitation could expose sensitive server resources, including files and databases, making the flaws particularly serious for organisations that process personal information or operate essential online services.

The foundation said the original investigation stalled because developers faced several difficult options, each carrying potential disadvantages. Some proposed fixes risked breaking backward compatibility, while others could introduce denial-of-service vulnerabilities or require extensive changes to third-party extensions. The security team also relied heavily on consensus when making decisions, which made it difficult to settle disagreements over the best approach. With a limited number of engineers possessing the necessary knowledge of PHP’s internal architecture, work repeatedly stopped and restarted over several months. The situation changed in August 2026, when security researchers at Calif and OpenAI independently reported the underlying problem, and Calif demonstrated a practical route to remote code execution. Further reports from organisations including Wiz helped establish the full severity of the issue, prompting the foundation to make the repair its highest priority.

The emergency disclosure also created difficulties for organisations responsible for maintaining websites and digital infrastructure. After details about the upcoming vulnerabilities began circulating online on October 20, the PHP project moved its security announcement and release forward by one day. The foundation said a security firm mistakenly published a video demonstrating a proof of concept, while security distributor Chainguard released patched images before the coordinated public disclosure. These events complicated the effort to give administrators enough time to prepare updates before attackers could study the vulnerabilities and develop exploits. Governments, businesses and other organisations subsequently took precautionary measures, with some temporarily disconnecting websites or services while applying patches. Security agencies urged operators to update affected PHP installations immediately because unpatched servers could face increased risks once technical information became publicly available.

In response, the PHP Foundation says it is changing its security processes and expanding the resources available to developers. It established an Ecosystem Security Team in May 2026 and added personnel to help assess reports, coordinate investigations and strengthen the codebase. The foundation is also moving away from consensus-only decision-making towards a system that allows decisions to be reached by majority, while encouraging compromises where necessary. Artificial intelligence tools have contributed to recent security research by helping identify potential vulnerabilities and validate reports, including work involving Anthropic and OpenAI technologies. However, the foundation stressed that experienced engineers are still required to assess findings, weigh compatibility concerns and implement reliable fixes. It has called on companies, hosting providers and governments that rely on PHP to provide sustained financial support for the engineers maintaining the language.

The incident highlights a growing challenge for the global technology industry as artificial intelligence makes it possible to discover software vulnerabilities faster than traditional research methods. Although AI-assisted security tools can help defenders identify problems that have remained hidden for years, the same discoveries can also give attackers new opportunities if vulnerabilities are not repaired and deployed promptly. The PHP case demonstrates that identifying a flaw is only one part of cybersecurity; organisations must also have the funding, expertise and decision-making structures needed to respond effectively. The PHP Foundation has released security updates for supported versions 8.2 through 8.5 and urged administrators to install the appropriate patches immediately. Organisations running older, unsupported versions face additional challenges because those versions may not receive the same security updates. The longer-term lesson is that critical open-source infrastructure requires sustained investment and effective security governance to keep pace with increasingly sophisticated threats.