The PHP project has shipped emergency security releases for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 after discovering two critical vulnerabilities that could let an unauthenticated attacker execute code on servers running PHP. Given that PHP powers a large share of the web’s backend infrastructure, including major platforms built on frameworks like WordPress and Laravel, these flaws affect an enormous number of production systems, and the PHP Foundation is urging anyone running PHP to update immediately.

What makes this disclosure unusual is that the PHP Foundation, which stewards the language’s development, did not just announce the fix. It published a detailed account of how the bugs were found, why one of them took roughly two years to resolve, and what structural changes are now underway to prevent similar delays in the future.

What the vulnerabilities actually affect

Both flaws live in core parts of the PHP engine: memory management and error handling, systems that nearly every PHP request touches regardless of the application running on top. That centrality is precisely what made the bugs dangerous and also difficult to patch. Changes to memory handling or error handling risk breaking backward compatibility, degrading performance, or forcing updates across the large ecosystem of third-party PHP extensions that many production systems rely on.

One of the vulnerabilities traces back to an out-of-memory (OOM) problem first spotted in 2024, during PHP’s first external security audit in years. That audit was funded by the Sovereign Tech Agency and organized through OSTIF, with the actual assessment carried out by the firm Quarkslab. While a PHP core developer, contracted by the PHP Foundation, was fixing a separate issue Quarkslab had flagged, they noticed early signs of the OOM bug. At the time, a theoretical exploit path was discussed, but no concrete attack vector existed, and other issues with clearer, more immediate impact took priority.

Why a known bug took two years to fix

The more striking part of the story is not the vulnerability itself but how long it sat unresolved. According to the Foundation, the PHP security team developed several competing fixes for the OOM problem, but each carried serious trade-offs: breaking backward compatibility, introducing new denial-of-service risks, or requiring coordinated changes across many third-party extensions that seemed logistically impossible to organize.

The security team operates on consensus, and without a clear winner among the proposed fixes, decision-making stalled. The Foundation’s own post is candid about this: it calls the delay “a structural failure” caused by both the team’s consensus-based decision process and a shortage of people with the deep engine knowledge needed to resolve it. A small group of core developers, already stretched across many responsibilities, kept restarting and abandoning fix attempts over months because there was no known path to remote code execution to force urgency.

That changed on August 11th, 2026. Ryan A, a researcher at security firm Calif, reported an unconditional remote code execution exploit built on the same root cause as the 2024 OOM finding. OpenAI independently reported the identical root cause the same day. Further attack vectors followed from Wiz on August 24th and from OpenAI again on September 18th, confirming that the theoretical risk flagged two years earlier was very real and exploitable.

How PHP has restructured its security operations

In response to the slow resolution, the PHP Foundation has made several organizational changes over recent months. In May 2026, it created a new Ecosystem Security Team to work alongside the existing PHP security team on triage, coordination, and hardening work, effectively adding capacity that didn’t exist before. The Foundation also brought in dedicated staff: Alexandre Daubois joined in July to help triage and fix security reports, and Daniel Scherzer joined in September specifically for hardening work.

The Foundation says the security team’s decision-making process is also changing, moving away from strict consensus toward a model where decisions can be made by majority vote and compromises are actively encouraged, rather than letting disagreement stall fixes indefinitely as happened with the OOM bug.

New tooling, including AI-assisted vulnerability scanning

Alongside process changes, the Foundation has adopted new technical tools. Volker Dusch, serving as AI Security Engineer in Residence at the Foundation, has reportedly improved communication between the security team and the Foundation itself. Earlier this year, PHP worked with Alpha-Omega to scan the codebase using Anthropic’s Claude Mythos, and has since added OpenAI’s Daybreak Red for validating vulnerability reports and exploits, along with sanitizer builds and reproduction environments matching PHP’s CI across every supported platform.

The project also joined the Patch the Planet program, through which security firm Calif began a formal audit of PHP on July 30th, 2026, an audit that directly led to the discovery of the unconditional RCE exploit less than two weeks later.

What this means for developers running PHP

For anyone operating PHP in production, the immediate action is straightforward: update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as possible, since the vulnerabilities allow unauthenticated code execution, among the most severe categories of security flaw. The official php.net announcement contains technical details on attack vectors and system-specific update instructions.

Beyond the immediate patch, the broader takeaway is about how open-source infrastructure projects like PHP fund and staff security work. The Foundation’s own account suggests that without external audits, dedicated hired security personnel, and new AI-assisted scanning tools, a known vulnerability with a theorized but unproven exploit path could have remained unresolved indefinitely. The post closes by noting that continued support from organizations depending on PHP is necessary to keep this security work funded and staffed going forward.

Frequently asked questions

Do all PHP versions need to update?
The security releases cover PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Anyone running an earlier version within these release lines should update to the patched version immediately.

Was the vulnerability actively exploited before the fix?
The source does not state that the flaw was exploited in the wild before disclosure; it describes responsible reporting by researchers at Calif, OpenAI, and Wiz through coordinated security programs.

Why did it take so long to fix a known issue?
The PHP Foundation attributes the delay to a consensus-based decision process among a small, overstretched security team, combined with the absence of a known concrete exploit path until mid-2026, which it has since acknowledged as a structural failure and is actively reforming.

Source: Today’s PHP security release, and how we’re strengthening security