PHP Foundation Admits Critical Flaw Went Unfixed for 2 Years

The PHP Foundation has admitted that a critical PHP vulnerability remained unresolved for nearly two years because of limited funding, insufficient developer resources, and internal organizational problems.

The vulnerability, CVE-2026-109618, involves out-of-memory (OOM) corruption and could allow attackers to execute malicious code remotely without authentication.

According to the PHP Foundation, developers first identified the issue in 2024 but failed to deliver a fix until October 2026.

The admission follows the October 21 emergency security updates addressing two critical PHP vulnerabilities that potentially affect millions of websites.

PHP Foundation blames funding shortages and internal delays

The PHP Foundation explained that developers initially struggled to identify a practical way to exploit the vulnerability, leading them to prioritize more immediate security threats.

However, fixing the problem proved complicated. Some proposed solutions would have broken backward compatibility, introduced new denial-of-service risks, or required extensive changes to third-party PHP extensions.

The organization also acknowledged that its consensus-based decision-making process contributed to repeated delays.

It described the situation as a structural failure involving insufficient resources and ineffective decision-making rather than a purely technical problem.

To prevent similar incidents, the PHP security team plans to introduce majority-based decisions and encourage compromises when developers cannot reach an agreement.

Early security leak forced PHP developers to release patches sooner

The PHP Foundation originally planned to disclose the vulnerabilities and release security updates on October 22 at 14:00 UTC.

However, information about both vulnerabilities began circulating online on October 20 after a security company accidentally published a video demonstrating a working proof of concept.

Although the company removed the video, copies continued spreading online.

PHP developers consequently moved the security release forward to October 21 at 14:00 UTC. They could not publish the patches earlier because software distributors needed additional time to prepare updated packages.

The early disclosure had significant consequences. As previously reported, millions of attacks targeted PHP websites within hours of the vulnerability disclosures, according to Cloudflare CEO Matthew Prince.

PHP Foundation calls for more financial support

The PHP Foundation is now calling on technology companies, hosting providers, cloud platforms, governments, and public institutions to provide additional funding for PHP security.

Despite PHP powering a significant portion of the internet, the organization says its security maintenance depends on a relatively small team of funded developers and volunteers.

It argues that more financial support would help developers address vulnerabilities faster and prevent critical security issues from remaining unresolved for years.

The incident also highlights how limited resources and slow internal decisions can leave widely used technologies exposed to serious security risks.