PHP Admits 'Structural Failure' Delayed Critical Security Patch Since 2024, Triggering Global IT Shutdowns

The PHP Foundation admitted a "structural failure" caused months of delays in patching a critical remote code execution vulnerability first identified in 2024. Emergency patches were released Wednesday to address two related flaws that allow unauthenticated attackers to execute code on vulnerable servers without logging in. Government agencies in the Netherlands, Finland, France, Germany, and Australia proactively took public websites and digital identity services offline to install the patches. The foundation stated a small core team and fears of disrupting the vast PHP ecosystem stalled the fix until security firm Calif and OpenAI independently proved an unconditional remote code execution path on August 11. Blockchain security firm SlowMist identified 793 crypto-related domains with direct PHP fingerprints out of 1,488 surveyed, though the PHP security team noted no functional exploits were active at the time of public disclosure. "We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources." — PHP Foundation.