PHP released emergency patches across four branches today — 8.5.12, 8.4.27, 8.3.36, and 8.2.35 — fixing two critical remote code execution vulnerabilities scored at CVSS 9.2. Both sit in the most fundamental layers of the engine: memory management (CVE-2026-109618) and error handling (CVE-2026-109619). On Apache with modphp, unauthenticated attackers can trigger full RCE before application code even runs. These aren't edge-case bugs. They touch nearly every PHP request. The vulnerability timeline tells the real story. The OOM corruption issue was first detected in 2024 during PHP's first external security audit in years, funded by the Sovereign Tech Agency through OSTIF and executed by Quarkslab. A theoretical exploit was identified, but no concrete attack vector materialized. Competing fix approaches — each carrying backward compatibility risks, denial-of-service potential, or ecosystem-wide extension changes — stalled the security team's consensus-based decision process for months. The PHP Foundation's post is unusually candid: 'the delay was a structural failure.' What broke the stalemate was external pressure arriving simultaneously from multiple directions. On August 11th, 2026, security firm Calif reported unconditional remote code execution with the same OOM root cause. OpenAI independently reported the identical root cause the same day. Wiz followed on August 24th, and OpenAI added further attack vectors on September 18th. Trail of Bits has also been auditing. Once real-world RCE was demonstrated, the PHP Foundation threw multiple full-time developers at the fix, eventually working weekends and around the clock. The disclosure process itself fractured. Two days before the planned release, CVE IDs leaked on social media with incorrect CVSS scores (10.0 vs actual 9.2) and wrong release times. Calif accidentally published a proof-of-concept video showing exploits against live targets, then deleted it — but copies circulated. Chainguard broke the embargo entirely on October 21st at 07:41 UTC, publishing patched container images more than six hours before coordinated disclosure, giving attackers a binary diff to study while everyone else waited. The PHP Foundation has responded with institutional changes. A new Ecosystem Security Team was created in May 2026. AI tools — Anthropic's Claude Mythos for scanning, OpenAI's Daybreak Red for exploit validation — are now part of the pipeline. The security team has shifted from consensus to majority-rule decisions. Since July 1st, the team has published 15 CVEs and triaged over 100 invalid or duplicate reports, many generated by AI-assisted vulnerability research that is increasing report volume faster than human capacity to handle it. The structural picture is what matters. PHP powers a vast share of the web — government services, banks, e-commerce, media — yet its security apparatus depends on a handful of foundation-funded developers and occasional volunteers. The Foundation is explicit that experienced engineers who understand the full PHP codebase are too few, and that AI tools accelerate bug discovery for attackers and defenders equally while doing nothing to resolve the hard architectural trade-offs that kept this fix stuck for over a year. This is an infrastructure maintenance problem wearing a security costume. The gap between how much the world depends on PHP and how much it invests in PHP's core security is the vulnerability that no CVE number captures.
