--- title: PHP knew about one of the flaws in 2024 but could not... description: The PHP Foundation says it found one of the two critical PHP2Shell flaws back in 2024 but stalled for months without agreeing on a fix. The bugs sit in memory... canonical: https://daily.dev/posts/php-knew-about-one-of-the-flaws-in-2024-but-could-not-agree-a-fix-7laxopvqv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PHP knew about one of the flaws in 2024 but could not agree a fix | daily.dev og:description: The PHP Foundation says it found one of the two critical PHP2Shell flaws back in 2024 but stalled for months without agreeing on a fix. The bugs sit in memory... og:url: https://daily.dev/posts/php-knew-about-one-of-the-flaws-in-2024-but-could-not-agree-a-fix-7laxopvqv og:image: https://api.daily.dev/og/posts/7LaXOpVQv.png og:image:alt: PHP knew about one of the flaws in 2024 but could not agree a fix og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PHP knew about one of the flaws in 2024 but could not agree a fix **[The Next Web](https://daily.dev/sources/tnw)** · 4 min read · 0 upvotes · 0 comments ## Summary The PHP Foundation says it found one of the two critical PHP2Shell flaws back in 2024 but stalled for months without agreeing on a fix. The bugs sit in memory management and error handling, parts nearly every request touches. Competing repairs each carried costs: one broke backward compatibility, one added a denial-of-service risk, one forced changes on thousands of extensions. The Foundation calls this a 'structural failure' from its consensus process and lack of resources. The fix leaked early, with CVE IDs circulating, a proof-of-concept video briefly published by Calif, and Chainguard breaking the embargo by publishing built images six hours early. The real severity score is 9.2, not the leaked 10.0. The Foundation has since formed an Ecosystem Security Team, hired two more engineers, and moved to majority-vote decisions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the PHP2Shell vulnerability and why did it take so long to fix? PHP2Shell refers to two critical PHP flaws in memory management and error handling, areas nearly every request touches. A core developer spotted the memory bug in 2024, but the security team could not agree on a repair: one option broke backward compatibility, another added a denial-of-service risk, and a third forced changes on thousands of extensions, so the fix stalled for months before the October 2026 patch. _Teams planning PHP upgrades can track disclosures like this on daily.dev before patching production._ ### What is the real CVSS severity score for the PHP2Shell vulnerabilities? The real severity score is 9.2, not the 10.0 that circulated when the CVE identifiers leaked early on forums and social media on October 20. The leaked information also carried a wrong release time, and no technical exploit details leaked at that point, according to the PHP Foundation's own account of the incident. _Developers weighing patch urgency can check severity details for vulnerabilities like this on daily.dev._ ### How did Chainguard and Calif break the embargo on the PHP2Shell disclosure? Calif, one of the firms that reported the bugs, mistakenly published a proof-of-concept video showing the exploit working against real targets before deleting it, though copies spread. Separately, more than six hours before the official release, Chainguard published built container images containing the fix, letting attackers study the patch in binary form while other users waited. _Anyone coordinating disclosures or patch rollouts can follow embargo mishaps like this on daily.dev._ ## Similar posts on daily.dev - [PHP rushes out emergency patches for two critical bugs AI found first](https://daily.dev/posts/php-rushes-out-emergency-patches-for-two-critical-bugs-ai-found-first-smuf7gcab) · The Next Web · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#php](https://daily.dev/tags/php) [View this post on daily.dev](https://daily.dev/posts/php-knew-about-one-of-the-flaws-in-2024-but-could-not-agree-a-fix-7laxopvqv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"PHP knew about one of the flaws in 2024 but could not agree a fix","url":"https://daily.dev/posts/php-knew-about-one-of-the-flaws-in-2024-but-could-not-agree-a-fix-7laxopvqv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/php-knew-about-one-of-the-flaws-in-2024-but-could-not-agree-a-fix-7laxopvqv"},"datePublished":"2026-10-21T16:05:34.928Z","dateModified":"2026-10-21T16:21:18.450Z","description":"The PHP Foundation says it found one of the two critical PHP2Shell flaws back in 2024 but stalled for months without agreeing on a fix. The bugs sit in memory...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ffd77cb80421cea6fca88bbd84739cbf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ffd77cb80421cea6fca88bbd84739cbf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/php-knew-about-one-of-the-flaws-in-2024-but-could-not-agree-a-fix-7laxopvqv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,open-source,php","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"PHP knew about one of the flaws in 2024 but could not agree a fix"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/php-knew-about-one-of-the-flaws-in-2024-but-could-not-agree-a-fix-7laxopvqv#faq","mainEntity":[{"@type":"Question","name":"What is the PHP2Shell vulnerability and why did it take so long to fix?","acceptedAnswer":{"@type":"Answer","text":"PHP2Shell refers to two critical PHP flaws in memory management and error handling, areas nearly every request touches. A core developer spotted the memory bug in 2024, but the security team could not agree on a repair: one option broke backward compatibility, another added a denial-of-service risk, and a third forced changes on thousands of extensions, so the fix stalled for months before the October 2026 patch. Teams planning PHP upgrades can track disclosures like this on daily.dev before patching production."}},{"@type":"Question","name":"What is the real CVSS severity score for the PHP2Shell vulnerabilities?","acceptedAnswer":{"@type":"Answer","text":"The real severity score is 9.2, not the 10.0 that circulated when the CVE identifiers leaked early on forums and social media on October 20. The leaked information also carried a wrong release time, and no technical exploit details leaked at that point, according to the PHP Foundation's own account of the incident. Developers weighing patch urgency can check severity details for vulnerabilities like this on daily.dev."}},{"@type":"Question","name":"How did Chainguard and Calif break the embargo on the PHP2Shell disclosure?","acceptedAnswer":{"@type":"Answer","text":"Calif, one of the firms that reported the bugs, mistakenly published a proof-of-concept video showing the exploit working against real targets before deleting it, though copies spread. Separately, more than six hours before the official release, Chainguard published built container images containing the fix, letting attackers study the patch in binary form while other users waited. Anyone coordinating disclosures or patch rollouts can follow embargo mishaps like this on daily.dev."}}]} ```