Today's PHP security release, and how we're strengthening security
PHP released urgent security updates for two critical RCE vulnerabilities, detailing significant strides in its security organization while acknowledging past failures. The coordinated disclosure was plagued by leaks, premature videos, and an embargo breach, sparking heated debate on HN about responsible disclosure and systemic issues in open-source security. The community grapples with who to blame and the long-term sustainability of PHP's security efforts.
The Lowdown
PHP has announced immediate security updates (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35) to address two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale state). These vulnerabilities affect fundamental parts of PHP's memory management and error handling, making them exceptionally serious and difficult to patch.
Here's a breakdown of the situation:
- Critical Vulnerabilities: Two RCE flaws allowed unauthenticated attackers to execute code, with one demonstrated against default Apache/mod_php setups.
- Delayed Fixes: The OOM vulnerability was first identified in 2024 during PHP's first external security audit in years. A fix was delayed for months due to the complexity of trade-offs, a consensus-based security team decision process, and lack of resources.
- Strengthened Security Efforts: In response, the PHP Foundation has significantly restructured its security operations, creating an Ecosystem Security Team, hiring dedicated engineers, and integrating AI-assisted tools like Anthropic's Claude Mythos and OpenAI's Daybreak Red for vulnerability scanning and report validation.
- External Contributions: Multiple security firms (Calif, OpenAI, Wiz, Trail of Bits) independently reported and confirmed aspects of these vulnerabilities, some through programs like OpenAI's "Patch the Planet."
- Chaotic Disclosure: The planned coordinated disclosure was severely disrupted. CVE IDs leaked two days early, Calif (one of the reporting security firms) mistakenly published a detailed PoC video (notably featuring an anime character), and Chainguard unilaterally broke the embargo by releasing patched Docker images six hours before the official release, allowing attackers to analyze fixes early.
- Call for Funding: The PHP Foundation emphasized that despite PHP powering a significant portion of the web, its core security work relies on a small, foundation-funded team. They urgently appealed to companies, hosting providers, and governments that depend on PHP for increased sponsorship to ensure sustainable security development.
PHP urges all users to update their installations immediately to mitigate these severe risks. The Foundation also stresses that ongoing financial support is crucial to prevent future structural issues from becoming emergencies and to grow the pool of engineers capable of deeply understanding and securing the PHP codebase.
The Gossip
Disclosure Debacle and the Blame Game
The HN discussion heavily scrutinized the chaotic vulnerability disclosure process. Many criticized Calif for their 'mistakenly' published PoC video, especially its unprofessional, anime-laden presentation, which some felt escalated panic. Chainguard received even harsher condemnation for unilaterally breaking the embargo by releasing patched Docker images hours early. While some commenters argued Chainguard acted responsibly given perceived 'in-the-wild' exploits or the already compromised disclosure, the prevailing sentiment was that their actions were a self-serving breach of trust that undermined weeks of coordinated effort, with calls for them to be excluded from future embargoes.
Structural Security Struggles
Commenters delved into the underlying structural issues highlighted by the incident. Significant concern was raised about the PHP security team's past consensus-based decision-making process, which delayed critical fixes. The perennial problem of underfunding for PHP's core security work, despite its pervasive use across the internet, was a recurring theme, with many expressing skepticism that this would fundamentally change. Some users also revived the long-standing debate about PHP's inherent security when written in C, suggesting a rewrite in memory-safe languages like Rust as a radical, albeit impractical, solution.
Docker Delay Dilemma
Frustration mounted over the delay in the availability of official Docker images containing the patch after the embargo lifted. Users reported significant waits, forcing some to build custom images or delay patching. This led to a discussion about the challenges open-source projects face in managing private build pipelines for sensitive security releases, contrasting it with public CI/CD systems. Many felt that having pre-built images ready for immediate release should have been a top priority given the severity and advance notice of the vulnerabilities, questioning the readiness of the distribution ecosystem.