Critical security vulnerability in PHP known since 2024 leads to crisis

A critical vulnerability in PHP, one of the fundamental technologies on the internet, has escalated into a crisis. An official statement released by the PHP Foundation revealed significant disruptions in managing the process related to the serious security flaw. The first indications were reportedly detected during a security audit funded by the German government in 2024, while the delay in the fix has brought to light issues that the foundation describes as a "structural failure." The process concerning the vulnerability has also sparked discussions during the publishing phase of the fix.

According to information shared on social media, details regarding the flaw surfaced on October 20. A security firm allegedly mistakenly released a video showing a potential attack scenario, while a company named Chainguard reportedly violated an embargo by sharing the fix over six hours before other announcements. The discussion highlighted a crucial point: the security of PHP relies on a limited number of developers. The statement from the PHP Foundation emphasized that the security of the language, used by banks, online stores, and public services worldwide, is dependent on a small group of developers.