The PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 today to fix two critical vulnerabilities that allow unauthenticated attackers to execute code on servers running PHP under certain conditions, according to the PHP Foundation.
Both vulnerabilities exist in core components that handle nearly every PHP request: memory management and error handling. This central placement made them difficult to fix without breaking backward compatibility, hurting performance, or requiring changes to third-party extensions.
The first signs of one vulnerability emerged during PHP’s 2024 external security audit, conducted by Quarkslab with funding from the Sovereign Tech Agency through OSTIF. While a potential exploit was theorized in 2024, no concrete attack vectors were identified until later.
According to the PHP Foundation, the delay in fixing the issue stemmed from structural challenges: the security team operated on consensus, struggled to choose among competing approaches with different trade-offs, and lacked sufficient resources. The small core developer team working on fixes had competing responsibilities.
Recent organizational changes have improved PHP’s security posture. In May 2026, the PHP Foundation created the Ecosystem Security Team to work alongside the existing security team on triage and coordination. The Foundation hired additional staff: Volker Dusch as AI Security Engineer in Residence, Alexandre Daubois in July to help triage and fix reports, and Daniel Scherzer in September for hardening work.
Multiple security firms identified the vulnerabilities’ full impact. Calif reported remote code execution on August 11th; OpenAI independently reported the same root cause the same day, with additional vectors on September 18th; Wiz reported another vector on August 24th; and Trail of Bits began auditing PHP more recently.
The coordinated disclosure faced complications. Two days before the planned release, CVE IDs circulated on forums and social media with incorrect details. The PHP project accelerated its pre-announcement and moved the release forward one day. Calif mistakenly published a proof-of-concept video showing the vulnerability working against targets, which was deleted but copies circulated. Chainguard unilaterally broke the embargo by publishing fixed images over six hours before the coordinated release, allowing attackers to study the fix while other users awaited the update.
The PHP Foundation notes the growth of AI-assisted security research has increased report volume. Since July 1st, the security team published 15 CVEs and reviewed over 100 invalid, duplicate, or irreproducible reports. The Foundation emphasizes that today’s release demonstrates improved coordination among the security team, Foundation, and release managers in delivering fixes across all supported branches.
Key facts
- PHP released four updated versions to patch critical remote code execution vulnerabilities in memory management and error handling
- The vulnerabilities were identified during a 2024 external security audit and later confirmed to have concrete exploit vectors by multiple security firms in August 2026
- Organizational changes including new security staff and the creation of an Ecosystem Security Team have improved PHP’s security response processes
- The coordinated disclosure was complicated by premature CVE circulation, a leaked proof-of-concept video, and one distributor breaking the embargo before the official release