The PHP Foundation details how it found and fixed the two flaws, and says it had to release patches a day early after the two CVE IDs began circulating online
Earlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases fix two critical vulnerabilities that …
The PHP Foundation
Context & Ripple Effects
PHP had signaled a coordinated fix window after two 9.2-rated flaws were identified as RCE issues; the project then issued security updates for web-serving PHP installations. The Foundation’s account explains why that timetable compressed after the CVE identifiers circulated publicly.
The patches cover PHP 8.2 and newer, leaving legacy deployments reliant on third-party vendors. That split makes patch availability only part of the remediation problem for organizations running unsupported branches.
First-order effects
PHP maintainers moved the release forward, giving administrators fixes for two confirmed unauthenticated RCE vulnerabilities but shortening their planned deployment window.
Organizations operating web-serving PHP installations must prioritize upgrades to the fixed releases; legacy users cannot obtain the Foundation’s patches directly.
Second-order effects
Third-party vendors supporting older PHP versions become the critical remediation path for legacy customers, creating uneven exposure across PHP estates.
The premature circulation of CVE identifiers turns coordinated disclosure into an operational race: defenders must deploy fixes before public issue details can aid attackers.
Third-order effects
The episode points to stronger pressure on language projects and image distributors to align embargo handling with release readiness, since metadata or prebuilt artifacts can collapse a planned disclosure window.
If unsupported PHP estates continue to depend on vendor fixes, security posture will increasingly be determined by support-channel coverage rather than upstream patch publication alone.
The trend: Critical open-source vulnerability response is becoming a supply-chain coordination problem, where release timing, package distribution, and legacy support shape real-world exposure.
The leak wasn't OpenAI's fault. Chainguard unilaterally broke the embargo by releasing built images with fixes before the vulnerabilities were disclosed, forcing maintainers to scramble to release the patches early. — This industry is small and you just can't treat people like…
PHP Foundation kind of found the first vuln in 2024 but “the PHP security team, operating on consensus, struggled to choose between these and feared the repercussions of shipping the wrong choice” — don't dunk on a bunch of volunteers for that; dunk on everyone depending on but…
We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. #php #security https://thephp.foundation/…
Must-read blog post from the PHP foundation: — > [ In 2024 ] a PHP core developer contracted by the PHP Foundation found the first signs of the [out-of-memory] OOM problem behind CVE-2026-109618. — > the lack of a known path to remote code execution and the small team of core…
Read the story around the security vulnerabilities fixed in PHP today that I wrote up for the PHP Foundation, what an exhausting last week in this process. Glad it's out, hoping you all update ASAP.
One thing I really don't understand is why, with Cloudflare already reporting attacks, @ThePHPF didn't release their fixes asap. I get the “once patched, the vuln is exploitable on unpatched servers.” But right now, EVERY server is exploitable. Is that better?!
Two critical PHP vulnerabilities (CVSS 9.2) were disclosed today, allowing unauthenticated RCE on default configurations. To help everyone patch fast we are making images for PHP 8.2, 8.3, 8.4, and 8.5 free for anyone to use. You can access them here: https://images.chainguard.de…