The PHP project has shipped updates for four release branches to fix two critical remote code execution flaws. The PHP Foundation also described how the bugs were found, what went wrong along the way, and why it needs more sponsors.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that could let an unauthenticated attacker run code on servers under the right conditions. Both flaws sit in memory management and error handling, which nearly every request touches. That made them serious and hard to fix without breaking compatibility or third-party extensions.
The PHP Foundation says early signs of the out-of-memory problem appeared during a 2024 audit by Quarkslab. A fix then stalled for months because the security team could not agree between several approaches, each with trade-offs. The Foundation calls the delay a structural failure and says the team is moving toward majority decisions. After Calif, OpenAI and Wiz reported attack vectors in August, fixing the issue became the top priority.
The disclosure did not go smoothly. The CVE IDs circulated online two days before the planned release, with an incorrect CVSS score of 10.0; the actual score is 9.2. PHP moved the release forward by a day. Calif accidentally published a proof-of-concept video, and Chainguard released fixed images more than six hours before the coordinated release.
The Foundation has since added an Ecosystem Security Team, new staff and more tooling. It says AI-assisted research raises report volume, yet people still make every decision. It urges organizations that depend on PHP to sponsor the Foundation so a small team can keep up.
Source: Hacker News (front page)
