The PHP Foundation has acknowledged that indecision and a shortage of resources delayed a fix for a critical security flaw first identified in 2024, calling the stalled response a “structural failure.”
Government agencies and other organizations worldwide took websites offline Wednesday as a precaution while PHP released emergency patches for two related critical vulnerabilities. The flaws could allow unauthenticated attackers to execute code on affected servers without logging in.
PHP is a programming language widely used to power websites and web applications, including content management systems.
In a blog post following the release of the patch, the foundation described how its developers first found signs of the vulnerability in 2024, but struggled to come up with a solution without disrupting the large ecosystem of software built using PHP.
“Combined with the lack of a known path to remote code execution and the small…
