PHP Foundation admits patch delay was a structural failure, vows stronger security

The PHP Foundation acknowledged that the delayed fix for an out-of-memory vulnerability was a structural failure: the security team could not agree on an approach due to backward-compatibility and denial-of-service risks, and a shortage of engine experts stalled work for months. The organization pledged to strengthen PHP security.

• The OOM fix delay was called a structural failure of the security team
• Candidate fixes broke compatibility, risked DoS, or required third-party extension changes
• A shortage of developers with deep engine knowledge stalled the fix for months