Link: https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html

Update: PHP Foundation Says a 2024 Audit Found the First Signs of the Flaw
In the same post, the PHP Foundation said a core developer first found signs of the out-of-memory flaw behind CVE-2026-109618 during PHP's 2024 external audit, but a working attack was only theorized and no concrete route to code execution was found then.
Competing fixes each risked breaking compatibility, opening denial-of-service paths, or forcing changes on third-party extensions, and a small team struggled to agree, so work on a fix stalled for months. The Foundation called the delay "a structural failure" of its decision process and its resources.

The 2026 reports from Calif, OpenAI and Wiz, which used AI tools, established the working exploit that made the flaw's full impact clear and moved the fix to the top of the queue. The Foundation said it has since changed how it makes security decisions and added staff and tooling to catch similar problems sooner.

They already knew about this shit and they just trying to fool your ass into loving the shit out of AI. Fuck the gipity and the baby skull crushers. Fucking clankers and their covert ads or pump and dump BS. AaaaahhHHhHhhHhh I phpooped my pants

Conspiracy nut job. The amount of CVEs in the past month cannot be explained by variance alone. Php2shell, Git Regex, and Linux today. All solid 9+ and git was a 10. And I heard the clanker immediately found a vulnerability in the php fix(censored). This is not business as usual.

Edit: going from CVE to exploit is very difficult and apparent vulnerabilities aren't always real.

Can you please share any details or a thread I can pull on regarding that fix being vulnerable? (I know you said censored, i’ll take anything you got)

Censored as in the changed code bits were left out

Oh…. Fuck