The PHP Foundation just published its account of today's security release. It covers how one of the two remote code execution bugs was first spotted back in 2024, why the fix took so long, and how the disclosure leaked the day before the release.

If you haven't updated yet, start with our article on the two vulnerabilities. PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix both. This post covers the story behind them, which adds to OpenAI's account of the php2shell disclosure.

The First Signs Came in 2024

In 2024, PHP had its first external security audit in years. The Sovereign Tech Agency funded it, OSTIF organized it, and Quarkslab did the work.

While fixing one of Quarkslab's findings, a PHP core developer contracted by the Foundation found the first signs of the out-of-memory problem behind CVE-2026-109618. Nobody found a concrete way to exploit it at the time, and other bugs with clearer impact took priority.

Why the Fix Stalled

The bug sits in memory management and error handling, code that nearly every request runs through. That made it hard to fix without breaking compatibility, slowing PHP down, or forcing changes on third-party extensions.

The security team came up with several competing fixes, and each had a trade-off. Because the team works by consensus, the effort stalled and restarted over months. The Foundation calls this "a structural failure, caused by both the security team's decision process and its lack of resources." The team has started changing its process so it can decide by majority.

The Reports That Restarted It

According to the Foundation, the reports arrived this summer:

  • August 11: Ryan A at Calif reported an unconditional RCE with the same root cause as the out-of-memory problem. OpenAI reported the same root cause that day.
  • August 24: Wiz sent its report.
  • September 18: OpenAI reported more ways to trigger it.

From August 11 on, this was the security team's top priority. The Foundation says its funding let several people work on it full time.

The Foundation's write-up also gives more detail on the second bug, CVE-2026-109619. It says the reporter demonstrated RCE against a real-world application on Apache with mod_php.

How the Disclosure Leaked

The Foundation says disclosure went well until two days before the target date. Here's its timeline, in UTC:

  • October 20, around 15:00: The two CVE IDs started circulating on forums and social media, with a wrong release time and a wrong CVSS score of 10.0. The real score is 9.2. No technical details leaked.
  • October 20, 19:30: The PHP team published its advance notice and moved the release up a day, from October 22 to October 21 at 14:00 UTC. Distributors were still packaging fixes.
  • October 20, around 20:00: Calif mistakenly published a video of its proof of concept running against several targets. Copies spread on social media, and the Foundation says the video helped others speed up their own exploit work.
  • October 20, around 23:00: Mitigation advice sent to some critical infrastructure providers may also have leaked.
  • October 21, 07:41: Chainguard published container images with the fix, more than six hours before the coordinated release. The Foundation says this "disregarded weeks of work by many parties toward a coordinated disclosure."

The security team says it watched and inspected the proofs of concept going around and "did not identify any functional exploits at the time of release/public disclosure."

What's Changing

The Foundation lists the work it's already done this year:

  • May 2026: It created the Ecosystem Security Team to work alongside the PHP security team on triage, coordination, and hardening.
  • July 2026: Alexandre Daubois joined to help triage and fix security reports.
  • September 2026: Daniel Scherzer joined to work on hardening.
  • Tooling: Alpha-Omega worked with the project earlier this year to scan PHP with Anthropic's Claude Mythos. The team has since added OpenAI's Daybreak Red for checking reports and exploits, plus sanitizer builds and reproduction environments for every supported platform.
  • Audits: The Foundation got PHP into OpenAI's Patch the Planet program. Calif started auditing PHP on July 30, and Trail of Bits is auditing it too.

The volume is high. The team has published 15 CVEs since July 1 and worked through more than 100 reports that turned out to be invalid, duplicates, or not reproducible. The Foundation says AI helps check and group reports, but "a person makes every call and works on every patch." Daubois explained that process in How the PHP Security Team Handles Your Reports.

Going forward, the Foundation says its leadership will help push serious, hard-to-fix bugs to a resolution sooner, and it plans to turn what it learned into repeatable processes.

A Call for Funding

The post ends with a request for sponsors. It names three groups: companies that build on PHP, hosting, cloud, and distribution providers, and governments and public institutions. The Foundation says it needs more funding to grow the number of engineers who know the PHP engine deeply enough to fix bugs like these.

You can sponsor the Foundation or get in touch about a larger commitment.

Read More

Read the full post on the PHP Foundation blog for the complete timeline and the list of people and companies it thanks.