Today's PHP Security Release, and How We're Strengthening PHP Security (PHP Foundation)

The PHP Foundation has recently released a blog post detailing the recent security vulnerabilities discovered in PHP and the challenges faced in resolving them. The team responsible for PHP's security had to consider several potential solutions, each with its own set of drawbacks. These included potential compatibility issues, the risk of new denial-of-service attacks, and the need for modifications to a large number of third-party extensions.

The consensus-based decision-making process within the PHP security team made it difficult to select the most suitable solution, as they were wary of the consequences of implementing the wrong choice. Additionally, the limited availability of core developers with the required expertise to address the issue further exacerbated the situation, leading to repeated delays in the development and implementation of a fix.

The PHP Foundation acknowledges that this delay was a structural failure, attributable to both the decision-making process of the security team and its limited resources.