PHP Foundation admits ‘structural failure’ delayed fix

The PHP Foundation said a delay in fixing one of two critical flaws in the PHP programming language "was a structural failure." It made the admission on Wednesday, October 21, after emergency patches went out and governments around the world took websites offline as a precaution, Reuters reported via The Standard. According to the foundation, a researcher found the first signs of one flaw in 2024, but no concrete way to attack it was found at the time, and other problems with clearer impact took priority.thestandard.com.hk

A fix that stalled for months

In a blog post excerpted by LWN, the foundation said its security team came up with several competing fixes. Each had a cost: one broke backward compatibility, one created a new denial-of-service risk, and one required changes to many third-party extensions. The team made decisions by consensus and "feared the repercussions of shipping the wrong choice," it wrote. Because no route to remote code execution was known, and the few core developers who know the engine well had many other duties, work "stall[ed] and restart[ed] repeatedly over months." "We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources," the foundation said.lwn.net

The issue became urgent again on August 11. That day, security firm Calif and OpenAI independently reported the same root cause, and Calif showed it could run code remotely without conditions, Cointelegraph reported. The foundation said it has since moved security decisions from consensus to majority vote and hired two more engineers. It also urged the companies and governments that rely on PHP to help pay for security work, The Next Web reported. The release was moved up a day after the vulnerability identifiers leaked online, and the foundation criticized Chainguard for publishing patched images before the coordinated release.tradingview.com+1

Websites go dark

The bugs, nicknamed PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and every PHP installation that serves web requests is potentially affected, The Register reported. Cybersecurity agencies in the US, UK, Canada, Australia and the European Union told website operators to take sites offline until they could update, Cybersecurity Dive reported. Security journalist Brian Krebs estimated that nearly 70 percent of websites need the update.theregister.com+2

The Netherlands shut down its digital identity service. Finland's state IT provider Valtori disconnected public web services, and France temporarily took prefecture websites offline, Cointelegraph reported. The Wikimedia Foundation also took some supporting services offline. Coinbase ↗ 3.65% said it found no exposed PHP instances.tradingview.com

The US Cybersecurity and Infrastructure Security Agency (CISA) said it had "not observed exploitation of these vulnerabilities" when it published its advisory. It warned, however, that they "pose a risk to organizations if left unpatched," according to Reuters.thestandard.com.hk