PHP maintainers knew of memory-handling flaw two years before public disclosure
Operators running end-of-life PHP versions now have patches reaching back to 7.4, and most installations online are on unsupported releases.
A post-mortem from the PHP Foundation says its small maintainer team had identified the flaw about two years before it became public. The bug stems from PHP's out-of-memory handling, which can jump execution mid-way through building a data structure and leave corrupted memory that an attacker can exploit for remote code execution, as in the PHP2Shell chain. Because PHP runs on a large share of websites and many installations still use end-of-life versions, the exposure is wide, though exploitation requires knowing the exact PHP version and build. Patches cover the currently supported branches 8.1 through 8.5, and the Foundation has also published fixes reaching back to 7.4. Operators of older versions can rely on community or commercial backports, while WAFs and CDNs can block malicious requests in the meantime.
Why it matters
The delay between internal discovery and disclosure leaves a long window in which the flaw could have been exploited, a concern for the many sites still running PHP versions without active support. Exploitation depends on an attacker knowing the exact PHP version and build, which narrows the immediate risk but does not remove it for those who cannot upgrade. Operators of older branches now depend on source patches and community or commercial backports, and until they apply them, filtering malicious requests at the web application firewall or CDN layer is the stopgap available.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.