Today's PHP Security Release, and How We're Strengthening PHP Security

The PHP project recently released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, which address two critical vulnerabilities that could allow unauthenticated attackers to execute code on servers running PHP if certain conditions are met. It is crucial for users of PHP to update their systems immediately. This article focuses on the discovery and resolution of these vulnerabilities, the evolution of PHP security handling over the past two years, and the support needed from organizations that rely on PHP to sustain the security efforts.

Both of these issues were found in parts of PHP that are extensively utilized in nearly every request: memory management and error handling. Due to their crucial role in PHP, these vulnerabilities were deemed serious and challenging to rectify without causing compatibility problems, performance degradation, or forcing changes on the extensive ecosystem of third-party extensions.

In 2024, PHP undertook its first external security audit in years, funded by the Sovereign Tech Agency through OSTIF, conducted by Quarkslab. While addressing one of the reported vulnerabilities, a PHP core developer discovered indications of an Out-of-Memory (OOM) problem.

In 2024, there was speculation about a potential exploit for the OOM issue, but no concrete vectors were identified. This concern was overshadowed by other significant issues. The PHP security team explored multiple solutions to resolve the OOM problem but faced trade-offs such as potential backward compatibility issues, the risk of introducing new denial-of-service vulnerabilities, or the need for modifications to numerous third-party extensions, making coordinated implementation challenging.

The team, operating through consensus, found it difficult to choose a solution and worried about the consequences of selecting the wrong approach. Combined with the lack of a clear path to remote code execution and the limited number of core developers with the requisite deep knowledge of the engine, the decision-making process became protracted and restarted multiple times over several months.

This delay can be attributed to both the security team's decision-making process and a lack of resources. Since then, the security team has reformed its processes, aiming for majority decisions and encouraging compromises.

The PHP Foundation established the Ecosystem Security Team in May 2026, working alongside the PHP security team for triage, coordination, and hardening. Notably, Volker Dusch's role as AI Security Engineer in Residence at the PHP Foundation has enhanced communication and collaboration between the security team and the Foundation.

Alexandre Daubois joined the Foundation in July to assist the PHP security team with security report triage, handling, and fixing. Daniel Scherzer joined in September to tackle hardening tasks. The PHP project collaborated with Alpha-Omega this year to scan PHP using Anthropic's Claude Mythos; however, beyond this initial scan, they have incorporated additional tools such as OpenAI's Daybreak Red for report and exploit validation, alongside sanitizer builds and replication environments to match PHP's CI on all supported platforms.

The PHP Foundation has integrated the PHP project into the Patch the Planet program, which includes a security audit from Calif security firm, starting July 30th, 2026. On August 11th, security researchers from Calif and OpenAI independently identified the same root cause for the OOM problem discovered in 2024, followed by additional attack vectors from OpenAI on September 18th and from Wiz on August 24th.

The reports from Calif, OpenAI, and Wiz clarified the full impact of the OOM problem, and from August 11th onward, fixing it has been the top priority for all PHP Foundation teams handling security. Thanks to the Foundation's funding, multiple people could work on this issue full-time, including work on weekends and around the clock to coordinate and communicate with other parties involved.

The increased involvement of AI-assisted research also means the PHP security team receives a higher volume of reports compared to previous years. As Alexandre Daubois explained last week in "How the PHP Security Team Handles Your Reports," the team has issued 15 CVEs since July 1st and processed over 100 reports, out of which more than 100 were deemed invalid, duplicates, or unproducible.

AI assists the team in validating reports and grouping reports sharing the same root cause, but every decision and patch still requires human intervention.