PHP developers published a report on the problems that arose in the process of fixing the critical vulnerabilities in PHP that were fixed yesterday. Information about the vulnerability that occurs when available memory is exhausted was obtained during an external audit back in 2024, but was perceived only as a theoretical possibility of an attack. The fix was delayed due to problems reaching consensus among PHP developers on how to fix the vulnerability. Several competing proposals to solve the problem were considered, each of which had its own disadvantages. The choice was between breaking backward compatibility, introducing new denial of service attack vectors, and having to make changes to many third-party add-ons.
A few months ago, Calif and Wiz independently used AI models GPT-5.6 and Gemini 4 Argon identified working methods for exploiting the problem and reported this to the PHP developers on August 11 and 24, 2026. Since then, patch development has been given the highest priority and decision-making has been reformed to allow for faster responsiveness to issues involving complex trade-offs (such decisions can now be made by majority vote without strict consensus).
The patch’s initial release date, coordinated with distributions, was set for October 22, but was then pushed back to October 21 after CVE identifiers and flawed data were leaked on social media on October 20 about the time of publication of the upcoming corrective releases.
Shortly after the announcement of the upcoming corrections to the Calif company, which identified one of the vulnerabilities, mistakenly published a video demonstrating the operation of the exploit, in which some details were visible that allowed us to narrow the scope of the search and reconstruct information about the problem. The video was quickly deleted, which only fueled the researchers’ desire to get to the bottom of the vulnerability and accelerated work on alternative exploit prototypes.
In addition, six hours before the scheduled publication of the fixes, Chainguard broke the embargo and published assemblies of its distribution containing a corrected version of PHP. Such a violation made it possible for attackers to study the fix before the official release, and also canceled out all the work on the coordinated disclosure of information and the simultaneous publication of fixes in different distributions.