The PHP Foundation has acknowledged that indecision and limited resources led to a structural failure that delayed a fix for a critical security flaw first identified in 2024.
The admission came in a detailed statement issued hours after the project released emergency patches for two related vulnerabilities that can let unauthenticated attackers run code on affected servers.
Government agencies and other organizations worldwide took public websites offline as a precaution while operators applied the updates. Services were temporarily unavailable in the Netherlands, Finland, France, Germany, Australia, and elsewhere after cybersecurity authorities, including the U.S. National Security Agency and the European Union’s CERT-EU, advised disconnecting unpatched systems if immediate remediation wasn’t possible.
PHP, the server-side language that powers a large share of the web—including content-management systems such as WordPress and Drupal—underlies an estimated 70 percent of identifiable websites, so the flaws touched a broad range of online services.
The two issues, tracked as CVE-2026-109618 and CVE-2026-109619 and sometimes labeled PHP2Shell, sit in core memory-management and error-handling paths that nearly every request touches.
One arises when an out-of-memory condition leaves partially initialized data that later cleanup routines treat as valid, enabling memory corruption and remote code execution.
The other involves stale global state that survives after a request’s memory is freed; a subsequent request handled by the same worker can then use the dangling pointer.
Both carry a CVSS v4.0 score of 9.2.
We demonstrated full remote code execution against Apache with the mod_php module under default settings, and confirmed additional vectors on PHP-FPM in certain configurations.
Supported branches were patched in releases 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Signs of the out-of-memory problem first surfaced in 2024, when a core developer addressed findings from an external audit by Quarkslab, organized through the Open Source Technology Improvement Fund and funded by Germany’s Sovereign Tech Agency.
At the time, exploitation remained theoretical; no concrete remote-code-execution path had been identified, and other issues with clearer impact took precedence.
Several competing repairs were drafted, but each had substantial drawbacks: one would break backward compatibility, another risked new denial-of-service conditions, and a third would require coordinated changes across many third-party extensions.
Operating by consensus and wary of shipping the wrong choice, the small team of developers with deep engine knowledge—already occupied with other duties—saw the work stall and restart repeatedly over many months.
The Foundation stated plainly that the delay constituted a structural failure rooted in both the security team’s decision process and its lack of resources.
It has since shifted toward majority-based decisions and encouraged pragmatic compromises.
The issue returned to the forefront on 11 August 2026, when security firm Calif and OpenAI independently reported the same root cause; Calif demonstrated unconditional remote code execution, elevating the problem to the highest priority.
OpenAI and Wiz later provided additional attack vectors.
Artificial intelligence tools played a notable role in the discoveries and subsequent validation.
Once the full impact was understood, Foundation-funded engineers, the security team, and release managers produced fixes across supported branches, with advance notice given to distributors.
Coordinated disclosure was disrupted two days before the planned release when the CVE identifiers began circulating with incorrect timing and severity information.
The project advanced its pre-announcement and moved the release forward by one day.
One of the reporting firms also published a proof-of-concept video in error, and supply-chain security company Chainguard released container images containing the patches more than six hours ahead of the coordinated window, allowing potential study of the binary fix while other users still awaited updates.
At the time of public disclosure, the security team had not identified any functional exploits in the wild.
In its statement, the Foundation described recent organizational changes—including an Ecosystem Security Team, additional contracted engineers, and expanded use of AI-assisted validation tools—and expressed cautious optimism that similarly complex issues will now reach leadership more quickly.
It also appealed for sustained sponsorship from companies, hosting providers, and public institutions that depend on PHP, noting that security work still rests on a limited number of funded developers.
