PHP vulnerability post-mortem reveals bug was known two years ago

In October 2026, OpenAI's GPT 5.6-Sol discovered critical vulnerabilities in the open-source programming language PHP. As published in a post-mortem report, a small team of maintainers had known about the issue for two years, delaying the fix due to compatibility challenges with third-party extensions.

• Agentic AI has exponentially accelerated vulnerability scanning, rendering the standard 90-day disclosure window obsolete.
• Approximately 70% of websites run on PHP, with 73% of installations using end-of-life versions lacking active support.
• The root cause stems from an ancient architectural decision involving the longjmp() C function in error handling.
• The active PHP2Shell exploit allows attackers to achieve remote code execution on vulnerable servers.

Architectural flaws and the longjmp() error handling bug

The technical root cause lies deep within an ancient architectural design in PHP's error-handling mechanism. When a PHP process runs out of memory, it calls the longjmp() C function, which abruptly redirects execution elsewhere without proper cleanup.

The core issue is that if this jump occurs while building a data structure like an array or object, half-baked data remains in the memory heap. When the cleanup mechanism runs, it acts upon these inconsistent leftover bytes, creating a severe security loophole.

The PHP Foundation's response and the legacy version crisis

The PHP Foundation admitted to management mistakes, pointing out that a tiny team of one full-time employee and fourteen part-time contractors struggled to maintain one of the world's most ubiquitous software packages. The situation was compounded by millions of servers running unsupported PHP 7 and older versions.

Many system administrators relied on Linux distribution backports or delayed updating their codebase. Consequently, the vast blast radius exposed tens of millions of servers globally to targeted attacks.

Mitigation strategies and the ongoing PHP2Shell threat

As the PHP2Shell exploit makes the rounds, developers and commercial vendors have rushed to release patches and backports for legacy PHP branches down to version 5.6. Entities like Debian developers, CloudLinux, and AlmaLinux have successfully produced security packages for older installations.

As a temporary defense, web application firewalls (WAFs) from Cloudflare, Fastly, and Immunify360, alongside server-level suites like CrowdStrike, are actively detecting and blocking malicious binary activity. Experts maintain that updating to a patched, supported PHP version remains the only proper fix.

What this means for developers and businesses: The PHP2Shell incident highlights the dangerous reality of technical debt and underfunded open-source maintainers. Organizations must immediately audit their infrastructure, patch legacy PHP versions, and implement robust multi-layered defenses.