Cyber ·
PHP security release and the reasons behind the delayed fixes
The PHP Foundation published a security release and explained that the delay in fixing the vulnerabilities came from technical deadlocks, lack of resources and structural flaws in the team's decision process.
The PHP Foundation published a blog post explaining how the vulnerabilities disclosed in the security release of October 21, 2026 emerged and why their fixes took so long. According to the text, the security team developed several competing approaches to an out-of-memory (OOM) problem, but each had drawbacks: backward compatibility breaks, new potential for denial of service, or changes needed in many third-party extensions, which seemed hard to coordinate. Working by consensus, the team struggled to choose between these options and feared the consequences of a wrong decision. The post also cited the lack of a known path to remote code execution and a reduced core team with the deep engine knowledge needed, busy with many other responsibilities. Together, these factors caused the work to stop and restart repeatedly over months. The Foundation states that the delay was a structural failure, caused both by the decision process and by a lack of resources. For teams running PHP, the relevant takeaway is to follow official advisories and apply fixed versions as soon as they are available. To consult the original, use the reference given in the LWN feed, which is a machine translation, and check the official PHP announcement for the list of affected versions before acting.