PHP Foundation acknowledges security process failure after delayed fix

• The PHP Foundation has acknowledged structural failures that delayed a critical security fix.
• The foundation released security updates and outlined changes to strengthen PHP’s security response.
• The review highlights resource constraints and decision-making problems in maintaining a widely used programming language.

The PHP Foundation released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October, fixing two critical remote-code-execution vulnerabilities.

The flaws could allow unauthenticated attackers to execute code on vulnerable servers under certain conditions, including default Apache configurations.

“We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources,” the PHP Foundation said in a statement.

Developers first identified the memory-management issue in 2024, but competing fixes and compatibility risks repeatedly stalled progress.

The security team is changing its decision process, encouraging majority decisions and compromises instead of requiring consensus.

The foundation created an Ecosystem Security Team in May 2026 and added developers to improve vulnerability handling and code hardening.

Since 1 July, the security team has published 15 CVEs and processed more than 100 invalid, duplicate or unreproducible reports.

The foundation says sustained funding and more experienced PHP engineers are needed to resolve complex security flaws before they become emergencies.