PHP Foundation: Critical vulnerabilities discovered as early as 2024, delays in fixes attributed to 'structural failures' The PHP Foundation released a post reviewing two severe vulnerabilities, admitting that their origins were exposed as early as the 2024 external security audit. Due to the complexity of balancing compatibility, performance, and the extension ecosystem, coupled with hesitation in decision-making by the security team and insufficient resources, the fix process faced multiple delays and restarts. The foundation has classified this as a 'structural failure.' It wasn't until this August, when security company Calif and OpenAI independently reported a remote code execution attack vector, that the fix was prioritized as the highest urgency.