PHP developers released a report on the issues that arose during the resolution of the critical vulnerabilities in PHP that were addressed yesterday. Information about the vulnerability related to memory exhaustion was obtained during an external audit back in 2024, but it was only regarded as a theoretical possibility for an attack. Fixing it was delayed due to disagreements among PHP developers on how to resolve the vulnerability. Several competing proposals were considered, each with its downsides. A choice had to be made between breaking backward compatibility, introducing new attack vectors leading to denial of service, and the necessity of making changes to numerous third-party extensions.
Several months ago, the companies Calif and Wiz independently identified effective exploitation methods using AI models GPT‑5.6 and Gemini 4 Argon, and informed PHP developers on August 11 and 24, 2026. Following this, the development of fixes was given the highest priority, and a reform of the decision-making process was initiated to respond more quickly to issues related to complex trade-offs (such decisions can now be made by majority vote without strict consensus).
Initially, in coordination with the distributions, the date for the release of the fix was set for October 22, but it was later moved to October 21 after a leak on October 20 on social media regarding CVE identifiers and incorrect data about the timing of the upcoming patch releases.
Shortly after the announcement of the upcoming fixes, Calif, which identified one of the vulnerabilities, mistakenly published a video demonstrating the exploit, revealing some details that could narrow down the search area and recreate information about the issue. The video was quickly deleted, which only fueled researchers' desire to dig into the vulnerability and accelerated work on alternative exploit prototypes.
In addition, six hours before the scheduled release of the fixes, Chainguard breached the embargo and published builds of its distribution containing the corrected version of PHP. This violation allowed malicious actors to study the fix before the official release and undermined all efforts for coordinated disclosure and simultaneous publication of fixes across different distributions.
Supplement: Sixteen hours after the details of the vulnerabilities of the universal exploit were disclosed, no mass attacks have been observed yet, which is explained by the complexity of exploiting the vulnerability due to the need to determine the layout of structures in the process's memory, which is specific to each build. The published working exploit prototypes are tied to specific configurations and conducting attacks under laboratory conditions. Additionally, many fake exploits have appeared, which are AI hallucinations, merely creating the appearance of an attack tied to configuration errors or only working in the presence of other critical vulnerabilities.
Source: opennet.ru
