PHP knew about one of the flaws in 2024 but could not agree a fix

PHP knew about one of the flaws in 2024 but could not agree a fix

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page au/news/thenextweb/wikipedia-ref-9-dation-structural-failure-2024-flaw-leak, snapshot 20261025T114552Z. Copied byte for byte; every file's sha256 is in captures/20261025T114552Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

The Next Web (English), 21 October: 'PHP knew about one of the flaws in 2024 but could not agree a fix', reporting a PHP Foundation blog post published on the day of the release. It says a core developer first spotted the memory-handling bug in 2024 while fixing a separate issue from PHP's first external security audit, that someone theorised a possible exploit but nobody found a concrete way in, and that the fix then stalled for months because the security team's competing repairs each carried a cost (one broke backward compatibility, one added a denial-of-service risk, one forced changes on thousands of third-party extensions). The Foundation wrote that the delay was a structural failure caused by the team's decision process and lack of resources. On the leak: on 20 October at about 15:00 UTC the two CVE identifiers began circulating on forums and social media with a wrong release time and a wrong severity score of 10.0 (the real figure is 9.2), with no technical details at that point; the Foundation brought the announcement forward and moved the release up a day, from 22 to 21 October; at about 20:00 UTC Calif mistakenly published a video of its proof of concept working against real targets, deleted but copied, which sped up public exploit code the next day; and more than six hours before the release Chainguard published built images containing the fix, which the Foundation says 'disregarded weeks of work by many parties toward a coordinated disclosure'. The team saw no working exploit by the time of release. The post also asks for money: the team published 15 CVEs since the start of July and worked through more than 100 others that proved invalid or duplicates.

> the delay was a structural failure, caused by both the security team’s decision process and its lack of resources

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP knew about one of the flaws in 2024 but could not agree a fix". Selected mechanically, not read by a person.

Capture notes

Language en. Nothing in the page addresses an AI or hides text from a reader.