Foundation behind PHP describes delay as "structural failure", has known about security flaw for over two years

The PHP Foundation acknowledged that a security vulnerability known for years led to significant website outages. The issue was first detected by experts in 2024, but its implications were unclear, causing other bugs to take precedence. Attempts to fix the vulnerability resulted in new problems, delaying resolution due to poor decision-making and staffing shortages. The urgency increased after AI tools highlighted the vulnerability's severity this summer. A software update was planned for October 22, but social media reports about the issue disrupted the timeline. The foundation is now seeking funding to prevent future delays and urges PHP users to support its development.