PHP Foundation says stalled security decisions delayed critical bug fix

The PHP Foundation has acknowledged that limited resources and its security decision-making process held up repairs to a critical vulnerability discovered in 2024. The flaw was one of two addressed in PHP2Shell patches released on 21 October after leaks disrupted the coordinated rollout.

In a blog post, the foundation said a core developer discovered the memory-management problem while addressing another issue identified through PHP’s first external security audit. A potential exploit was suggested, but no concrete attack method emerged at that stage, and developers prioritized other problems.

Proposed fixes presented different drawbacks: incompatibility with older software, a possible denial-of-service vulnerability or changes affecting thousands of third-party extensions. The foundation said its small security team struggled for months to reach consensus, describing the delay as a structural failure.

The disclosure schedule unraveled on 20 October, when identifiers for both vulnerabilities circulated online with an incorrect release time and a severity rating of 10.0 rather than 9.2. The foundation advanced its announcement and shifted the patch release from 22 October to 21 October.

The foundation said security firm Calif then mistakenly posted a demonstration video, which spread despite being deleted. It also said Chainguard distributed software images incorporating the patch more than six hours before the scheduled release, allowing attackers to examine the changes before other users could obtain updates.

The foundation said it had established an Ecosystem Security Team in May and hired two additional engineers over the summer. It is also replacing consensus-based security decisions with majority voting.

Appealing for sponsorship from companies, hosting providers and governments using PHP, the foundation said its team had published 15 CVEs since July began and reviewed more than 100 reports that were invalid or duplicates.