# Today's PHP Security Release, and How We're Strengthening PHP Security (PHP Foundation)

DevFeed: [Today's PHP Security Release, and How We're Strengthening PHP Security (PHP Foundation)](<https://devfeed.tech/articles/today-s-php-security-release-and-how-we-re-strengthening-php-security-php-foundation-93172.md>)

Original publisher: [Read original article](<https://lwn.net/Articles/1102060/>)

Author: corbet

Published: 2026-10-21T20:20:34Z

Content type: article

Language: en

Sources: [LWN.net](<https://devfeed.tech/sources/lwn-net.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [cve remediation](<https://devfeed.tech/topics/cve-remediation.md>), [Post Mortem](<https://devfeed.tech/topics/post-mortem.md>)

Tags: [compatibility](<https://devfeed.tech/tags/compatibility.md>), [consensus](<https://devfeed.tech/tags/consensus.md>), [core](<https://devfeed.tech/tags/core.md>), [delay](<https://devfeed.tech/tags/delay.md>), [denial-of-service](<https://devfeed.tech/tags/denial-of-service.md>), [engine](<https://devfeed.tech/tags/engine.md>), [extensions](<https://devfeed.tech/tags/extensions.md>), [failure](<https://devfeed.tech/tags/failure.md>), [oom](<https://devfeed.tech/tags/oom.md>), [php](<https://devfeed.tech/tags/php.md>), [release](<https://devfeed.tech/tags/release.md>), [remote-code-execution](<https://devfeed.tech/tags/remote-code-execution.md>), [resources](<https://devfeed.tech/tags/resources.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

The PHP Foundation attributes the months-long delay in fixing the OOM issue to a structural failure in security decision-making and resourcing. Competing fixes risked breaking backward compatibility, enabling denial of service, or requiring coordinated changes across many third-party extensions. The consensus-based security team struggled to choose among them, while the small number of core developers with deep engine expertise had many other responsibilities. With no known path to remote code execution, work repeatedly stalled and restarted.

## Source excerpt

The PHP Foundation has put out a blog entry explaining how the vulnerabilities disclosed today came about and why they took so long to fix. To fix the OOM problem, the PHP security team developed several competing approaches, but each came with its own trade-offs: backward compatibility breaks, new denial-of-service potential, or requiring changes to many third-party extensions which seemed impossible to coordinate. The PHP security team, operating on consensus, struggled to choose between these and feared the repercussions of shipping the wrong choice. Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months. We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources.