Key facts
Each fact is linked to the source that supports it.- The PHP Foundation says signs of the memory-handling problem appeared during a 2024 external security audit, but no concrete exploit vector was found at the time. The Record (Recorded Future News)
- The Foundation describes the delay as a 'structural failure' caused by its security team's decision process and lack of resources. The Record (Recorded Future News)
- A Calif researcher reported the bugs on 11 August 2026. OpenAI, Wiz and Trail of Bits also independently surfaced related issues, according to the Foundation. The Record (Recorded Future News)
- PHP moved the release up by a day after details leaked. The Foundation says it had not identified functional exploits at the time of release, although vendors later reported attempts. The Record (Recorded Future News)
The Foundation’s account
The PHP Foundation published an unusually candid account of how the PHP2Shell fixes were delayed. According to reporting by The Record, it said the first signs appeared in 2024 during PHP’s first external security audit in years. No concrete exploit vector was found then, and the work stalled while the team weighed competing fixes with backward-compatibility, denial-of-service and extension-ecosystem costs.
The issue returned to the top of the queue in August 2026. A researcher using the handle Calif reported the bugs on 11 August. OpenAI, Wiz and Trail of Bits independently surfaced related issues, according to the Foundation. From that point, fixing them became the security team’s top priority.
Why the process matters
The statement is a process postmortem, not a technical advisory. It matters because it explains why a critical runtime flaw was known in outline for roughly two years before a coordinated release. The Foundation describes a small group of engine experts, a consensus-based security team and a shortage of resources. It says it will move to majority decisions when developers cannot agree and is asking large beneficiaries of PHP to fund security work.
The disclosure itself also went wrong. Details and CVE identifiers leaked on 20 October. A proof-of-concept video was published early and recirculated after deletion. Chainguard published fix-containing images more than six hours before the coordinated release, which the Foundation says let attackers study the patch in binary form.
What this does not change
Process failures do not alter the technical facts. The fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The interim controls remain partial. The Foundation’s statement that it had not identified functional exploits at release is also not a denial that attempts occurred: SecurityWeek later reported an Amazon honeypot attempt on 17 October, before the release. Both statements can be true at once, and this site records them separately.
Sources for this page
- Full text read
Revision history
| Time (UTC) | Recorded change |
|---|---|
| 22 October 2026, 16:45 UTC | Added the distinction between the Foundation's pre-release exploit assessment and later vendor reports of attempts. |
| 22 October 2026, 16:45 UTC | Current published version. |
This is an independent summary written by PHP2Shell Live. It is not a republished article and is not an official notice from PHP, any vendor or any agency. Read the editorial policy.