I’m really glad I stopped using PHP years ago. You really wouldn’t want to be caught running it right now. Not only because of PHP2Shell, that seems to be only the tip of the proverbial iceberg. This is from the PHP projects offical news release on that monumental security issue:

In 2024, PHP underwent its first external security audit in years. The PHP Foundation secured funding from the Sovereign Tech Agency to organize this audit through OSTIF, and it was carried out by Quarkslab. While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem behind CVE-2026-109618. In 2024, a potential exploit for the OOM problem was theorized, but no concrete vectors were found and other concrete issues with clear impact overshadowed these concerns.

Why doesn’t this project have regular external security audits? It runs 70% of the web, for fuck’s sake! And what do you mean you knew of this problem two years ago but couldn’t figure it out? What are the chances that other people did and just didn’t tell you? I am now almost completely convinced that these vulnerabilities must have been exploited as zero days for years. This is an absolute disaster for this project.

To fix the OOM problem, the PHP security team developed several competing approaches, but each came with its own trade-offs: backward compatibility breaks, new denial-of-service potential, or requiring changes to many third-party extensions which seemed impossible to coordinate. The PHP security team, operating on consensus, struggled to choose between these and feared the repercussions of shipping the wrong choice. Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months. We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources. The security team has since started changing its processes, and that work continues, so that decisions can be made by majority and compromises are encouraged.

Maybe give your security team more resources then? Nah, features have always been more important than security to these guys. Let’s face it. People … stop using PHP!

Thanks to John Chandler, who alerted me to this post by the PHP people!

↵ Back to home