PHP Foundation Acknowledges Delay in Critical Vulnerability Fix as Structural Failure
The PHP Foundation stated that due to indecision and insufficient resources, the repair work for a critical security vulnerability discovered in 2024 has repeatedly stalled and restarted, characterizing the delay as a "structural failure."
PHP is a programming language widely used for websites and web applications. PHP has released emergency patches for two related critical vulnerabilities. Unauthenticated attackers could exploit the vulnerabilities to execute code on affected servers without logging in.
The two vulnerabilities are CVE-2026-109618 and CVE-2026-109619, both rated 9.2, involving memory management and error handling paths, affecting nearly every request; complete remote code execution has been demonstrated under the default configuration of Apache mod_php, and the PHP-FPM path has also been confirmed to be exploitable.
Some government websites or online services in the Netherlands, Finland, France, Germany, and Australia temporarily went offline to prepare for patch installation; in the Netherlands, this included DigiD, MijnOverheid, and parliamentary websites, while Finland's Valtori shut down several public services, and some French interior ministry websites also went offline temporarily.
Signs of the vulnerabilities first appeared in an external audit in 2024, but due to the lack of a clear exploitation path, compatibility or denial-of-service risks in the repair plan, the need to coordinate numerous third-party extensions, and the small size of the core security team relying on consensus decision-making, work repeatedly stalled; it was only after an unconditional remote code execution was independently reported by Calif and OpenAI on August 11 that it was elevated to the highest priority.
Prior to public disclosure, the leak of CVE identifiers led to an early announcement, with patches released on October 21 (versions 8.5.12, 8.4.27, 8.3.36, 8.2.35); website operators and hosting providers urgently upgraded or went offline to reduce exposure, with funds and resources directed towards patch deployment and security hardening, benefiting large sites and cloud service providers that updated in time, while smaller sites and government services still running old versions or unable to patch quickly faced pressure.
Source: Public Information
ABAB AI Insight
The PHP Foundation has long relied on a small core developer team to maintain the language engine, with security decisions based on consensus; signs of memory handling issues were identified in an external audit in 2024, but due to the repair plan involving backward compatibility breaks, potential denial-of-service risks, or the need to coordinate thousands of third-party extensions, the team repeatedly stalled until external researchers (including OpenAI-related work) demonstrated unconditional remote code execution in August 2026, which accelerated the process.
In terms of capital and resource pathways, the foundation has limited resources, with core engine knowledge concentrated in a few individuals, leading to competition between security work and daily maintenance for priority; following this incident, the foundation began adjusting its decision-making process from consensus-based to majority vote and encouraged compromise, while also calling on corporate users to increase security funding, motivated by the desire to avoid delays in critical path repairs due to compatibility concerns.
This is similar to the early disclosure delays of OpenSSL Heartbleed and the postponement of early Linux kernel security patches due to ecosystem compatibility disputes; it is currently in a phase where foundational language and runtime security is transitioning from a human consensus model to AI-assisted discovery and enforced prioritization, with AI now capable of reproducing complex exploit chains within hours.
Essentially, this reflects a change in regulation and a restructuring of governance: shifting from a maintenance model reliant on small team consensus to a necessary infrastructure security model that must establish mandatory decision-making mechanisms and external funding; the cause of this is that the language engine is on the critical path of nearly all requests, making any repair costly, while insufficient resources and decision inertia have allowed known issues to linger, with external AI and researchers' reports ultimately breaking the stalemate.
ABAB News · Cognitive Laws
Consensus decision-making on critical paths equals delays
Known vulnerabilities + insufficient resources = structural exposure
From human consensus to enforced prioritization is a turning point for infrastructure security