Today's PHP security release, and how we're strengthening PHP security
A · Strong evidence The PHP Foundation's own post-mortem gives a dated account of how a known root cause stalled for two years, who reported what and when, and how the embargo broke, including an open admission of structural failure.
Summary based on the full text·Original: about 9 minutes to read
In short
The PHP Foundation's 21 October 2026 post on the release of PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix two critical remote code execution flaws (CVE-2026-109618 and CVE-2026-109619) in memory management and error handling. The root cause was first spotted in 2024 during a funded external audit, but the security team, deciding by consensus with few engine experts, could not choose among fixes with costly trade-offs, so work "stall[ed] and restart[ed] repeatedly over months". Reports from Calif, OpenAI and Wiz in August and September 2026 showed the full impact and forced the fix.
Key numbers
- 15CVEs published by the PHP security team since 1 July 2026
- more than 100reports since 1 July that proved invalid, duplicate or not reproducible
- 9.2actual CVSS score of the two RCE vulnerabilities; a leaked 10.0 was wrong
- 07:41 UTCtime on 21 October when Chainguard published fixed images, more than six hours before the coordinated release
As reported by the source.
English·Web page·opens thephp.foundation
What it reports
- CVE-2026-109618: hitting
memory_limitat the wrong moment leaves partly initialised data; on Apache with mod_php, an unauthenticated request triggers it before application code runs, with RCE shown on default settings. CVE-2026-109619: stale global state after a fatal error leads to a use-after-free on the next request. - 2024: first external audit in years (Quarkslab, organised by OSTIF, funded by the Sovereign Tech Agency) surfaced first signs of the OOM problem; no exploit path was found then.
- Calif began an audit on 30 July 2026; Ryan A reported unconditional RCE with the same root cause on 11 August. OpenAI reported the same root cause independently; Wiz added vectors on 24 August and OpenAI on 18 September. Trail of Bits has also been auditing PHP.
- The security team has published 15 CVEs since 1 July and handled more than 100 invalid, duplicate or non-reproducible reports. AI tools help validate and group reports; a person makes every call and writes every patch.
- Tools used: a scan with Anthropic's Claude Mythos via Alpha-Omega, OpenAI's Daybreak Red for validating reports and exploits, sanitizer builds and CI-matched reproduction environments.
- Disclosure broke down: CVE IDs leaked on 20 October around 15:00 UTC with a wrong CVSS of 10.0; release moved forward a day; Calif mistakenly published a proof-of-concept video; Chainguard broke the embargo at 07:41 UTC on 21 October.
- Process changes: security decisions move to majority vote, a new Ecosystem Security Team (May 2026) and new hires for triage and hardening.
How they got it
First-hand account by the maintainers' foundation, with dates and named parties. It is a narrative post-mortem, not an audited report.
Limits
- Written by an interested party that ends with a funding appeal; blame for the leak is assigned to others without their response.
- No data on exploitation in the wild; the team says it saw no functional exploits at release time.
- Report counts are totals without a pre-AI baseline.
Why it matters for companies
The bottleneck was decision capacity, not discovery: the bug was known in 2024 and fixed only when outside AI-assisted reports made it urgent. Firms that build on PHP or other community runtimes are exposed to that thin layer of maintainers and should fund it, as the post asks. The account also shows that pre-release patch access is now a leak risk: a fixed binary published hours early is enough for attackers to diff. Plan for disclosures arriving a day early.
Summary based on the full text. Read the original for the full argument and data.Read the original on thephp.foundation
- Tags
- AI security, Disclosure