PHP Foundation admits a structural failure delayed its critical RCE fix for months
PHP Foundation's Overview of CVE-2026-109618 and CVE-2026-109619
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 patch two critical RCE flaws: one triggered by out-of-memory corruption, the other by stale state after a fatal error. The Foundation says the OOM issue was spotted in 2024 but stalled for months because the consensus-driven security team couldn't agree on a fix, and calls that delay a structural failure. It also describes a leak, an early Chainguard release, and a new Ecosystem Security Team.
We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources.