A security vulnerability (CVE-2026-65954, CVSS 8.6) in PHPCSUtils was discovered where the `AbstractArrayDeclarationSniff` class passed source code from files under analysis directly to `eval()`, allowing arbitrary code execution during static analysis. The author explores why PHP's `disable_functions` cannot block `eval()` (it's a language construct, not a function, compiled to the `ZEND_INCLUDE_OR_EVAL` opcode), then proposes and implements a new `zend.disable_eval` INI setting in a PHP 8.6 development build. The patch adds a runtime check in the opcode handler, making it compatible with JIT and leaving C-level APIs (used by `php -r`, `php -a`, debuggers) unaffected. A related PHP-Parser vulnerability (versions 5.6.0–5.7.0) where the pipe operator `|>` caused dynamic function calls during constant expression evaluation is also discussed, illustrating that `eval()` is not the only way static analysis tools can inadvertently execute code. The author argues for `zend.disable_eval` as an opt-in hardening mechanism for code-analysis services, noting it would need to go through PHP's RFC process.
